In breve
- CVE-2021-43138 è una vulnerabilità ALTO (CVSS 7.8) che riguarda async (async project), async.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.3%, superiore al 88.7% delle vulnerabilità.
- Correzione: aggiornare a 3.2.2, 2.6.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| async | ≥ 3.0.0, < 3.2.2< 2.6.4
| 3.2.22.6.4
|
| async npm | ≥ 2.0.0, < 2.6.4≥ 3.0.0, < 3.2.2
| 2.6.43.2.2
|
Description
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.
NVD description
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free