CVE-2022-21213

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-212147.8The affected product is vulnerable to a heap-based buffer overflow, which may lead to code execution.CVE-2022-212159.8This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are CVE-2022-212166.8Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a pr CVE-2022-212179.8An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-craft CVE-2022-212185.5Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable CVE-2022-212197.8Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause in CVE-2022-21227.8DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which ca CVE-2022-212207.8Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to CVE-2022-212217.5The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sani CVE-2022-212227.5The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expres CVE-2022-212239.8The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download funct CVE-2022-212258.0Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enabl