CVE-2021-23702

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-23717.5Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 3.7.1.CVE-2021-237187.5The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to propCVE-2021-23724.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior andCVE-2021-237277.5This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When readinCVE-2021-23735.4Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). Supported versions that are affecCVE-2021-237329.0This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controllCVE-2021-23744.1Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. DiCVE-2021-23756.1Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). Supported versions that are affecCVE-2021-237589.8All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitraryCVE-2021-23767.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affecCVE-2021-237609.8The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to causeCVE-2021-23774.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected a
CVE-2021-23702: Critical severity, CVSS 9.8 | Vulnix