p PatchFirst

CVE-2021-23682

CVE-2021-23682 · Prototype Pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

CVSS 7.3 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: php · node

Affected products and versions

  • litespeed.js

    Versions
    • ≥ unspecified, < 0.3.12: Affected (custom)

    Update to 0.3.12

  • appwrite/server-ce

    Versions
    • ≥ 0.12.0, < unspecified: Affected (custom)
    • ≥ unspecified, < 0.12.2: Affected (custom)
    • ≥ unspecified, < 0.11.1: Affected (custom)

    Update to 0.11.1; Update to 0.12.2

  • litespeed.js npm

    Affected ranges
    • SEMVER: < 0.3.12

    Update to 0.3.12

  • appwrite/server-ce Packagist

    Versions
    • 0.12.0
    • 0.12.1
    Affected ranges
    • ECOSYSTEM: ≥ 0.12.0, < 0.12.2

    Update to 0.12.2

  • appwrite/server-ce Packagist

    Versions
    • 0.1.13
    • 0.1.15
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.10.4
    • 0.11.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.9
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.4
    Affected ranges
    • ECOSYSTEM: < 0.11.1

    Update to 0.11.1

Original sources

Check your server →