CVE-2021-23682: Prototype Pollution
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-23682?
CVE-2021-23682 has a medium severity rating due to improper input sanitation which could lead to prototype pollution.
How do I fix CVE-2021-23682?
To fix CVE-2021-23682, update the litespeed.js package to version 0.3.12 or higher, and the Appwrite package to version 0.12.2 or above.
What versions are affected by CVE-2021-23682?
CVE-2021-23682 affects litespeed.js versions before 0.3.12 and Appwrite versions from 0.11.1 to 0.12.1.
What type of vulnerability is CVE-2021-23682?
CVE-2021-23682 is classified as a prototype pollution vulnerability due to improper handling of query strings.
Can CVE-2021-23682 lead to further exploits?
Yes, CVE-2021-23682 can lead to other exploits by allowing an attacker to manipulate the prototype of objects.