Client-Side JavaScript Prototype Pollution in oro/platform

CAO 8.8CVE-2021-43852 · GHSA-jx5q-g37m-h5hj · Công bố 04/01/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-43852 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng oro/platform, oroplatform (oroinc).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 66.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.1.14, 4.2.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
oro/platform Packagist	`≥ 4.1.0, < 4.1.14≥ 4.2.0, < 4.2.8`	`4.1.144.2.8`
oroplatform oroinc	`≥ 4.1.0, < 4.1.14≥ 4.2.0, < 4.2.8`	`4.1.144.2.8`

Mô tả

Summary

By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution.

Workarounds

Configure WAF to drop requests containing next strings: __proto__ , constructor[prototype], constructor.prototype

Mô tả của NVD

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.