What is the severity of CVE-2021-23497?

CVE-2021-23497 is classified as a critical vulnerability due to its potential to cause denial of service and remote code execution.

How do I fix CVE-2021-23497?

To fix CVE-2021-23497, upgrade the package @strikeentco/set to version 1.0.2 or later.

What causes CVE-2021-23497?

CVE-2021-23497 is caused by an incomplete fix which allows for type confusion leading to denial of service.

What systems are affected by CVE-2021-23497?

CVE-2021-23497 affects versions of the package @strikeentco/set prior to 1.0.2.

Can CVE-2021-23497 be exploited remotely?

Yes, CVE-2021-23497 can potentially lead to remote code execution, making it exploitable remotely.

Vulnerability/
CVE-2021-23497

critical

9.8

CWE

1321

4/2/2022

16/9/2024

CVE-2021-23497: Prototype Pollution

First published: Fri Feb 04 2022(Updated: )

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821

Credit: report@snyk.io

Affected Software	Affected Version	How to fix
Set-value Project	<1.0.2

Remedy

https://github.com/strikeentco/set/commit/b2f942c

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-23497?
CVE-2021-23497 is classified as a critical vulnerability due to its potential to cause denial of service and remote code execution.
How do I fix CVE-2021-23497?
To fix CVE-2021-23497, upgrade the package @strikeentco/set to version 1.0.2 or later.
What causes CVE-2021-23497?
CVE-2021-23497 is caused by an incomplete fix which allows for type confusion leading to denial of service.
What systems are affected by CVE-2021-23497?
CVE-2021-23497 affects versions of the package @strikeentco/set prior to 1.0.2.
Can CVE-2021-23497 be exploited remotely?
Yes, CVE-2021-23497 can potentially lead to remote code execution, making it exploitable remotely.

agent/remedy
agent/weakness
agent/severity
agent/author
agent/references
agent/title
agent/softwarecombine
agent/type
agent/description
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/set project
canonical/set-value project

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2021-23497?
CVE-2021-23497 is classified as a critical vulnerability due to its potential to cause denial of service and remote code execution.
How do I fix CVE-2021-23497?
To fix CVE-2021-23497, upgrade the package @strikeentco/set to version 1.0.2 or later.
What causes CVE-2021-23497?
CVE-2021-23497 is caused by an incomplete fix which allows for type confusion leading to denial of service.
What systems are affected by CVE-2021-23497?
CVE-2021-23497 affects versions of the package @strikeentco/set prior to 1.0.2.
Can CVE-2021-23497 be exploited remotely?
Yes, CVE-2021-23497 can potentially lead to remote code execution, making it exploitable remotely.