CVE-2021-23438: Prototype Pollution

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/208595
• https://www.ibm.com/support/pages/node/6615285 (Advisory)
• https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548
• https://snyk.io/vuln/SNYK-JS-MPATH-1577289

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6615285

Frequently Asked Questions

• What is CVE-2021-23438?

  CVE-2021-23438 is a vulnerability in the Node.js mpath module that could allow a remote attacker to execute arbitrary code on the system.

• How severe is CVE-2021-23438?

  CVE-2021-23438 has a severity rating of 9.8 out of 10, which is considered critical.

• Which software is affected by CVE-2021-23438?

  The package mpath before version 0.8.4, Node.js mpath module, IBM Cognos Analytics 11.2.x, and IBM Cognos Analytics 11.1.x are affected by CVE-2021-23438.

• How can CVE-2021-23438 be fixed?

  To fix CVE-2021-23438, update the mpath package to version 0.8.4 or higher.

• Where can I find more information about CVE-2021-23438?

  More information about CVE-2021-23438 can be found at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-23438), [GitHub](https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc), [Snyk](https://snyk.io/vuln/SNYK-JS-MPATH-1577289).