Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

bmoor version before 0.10.1: Data Tampering through Malicious Input

CVE-2021-23558 · published 4 years ago
Summary

Using bmoor version 0.10.1 or later is recommended. Developers using an earlier version should update it as soon as possible. This vulnerability could allow an attacker to alter the behavior of your application by submitting malicious data.

What to do
  • Update b-heilman bmoor to version 0.10.1.
  • Update bmoor_project bmoor to version 0.10.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm b-heilman bmoor < 0.10.1
Fix: upgrade to 0.10.1
– bmoor_project bmoor < 0.10.1
cpe:2.3:a:bmoor_project:bmoor:*:*:*:*:*:node.js:*:*
Original advisory text
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](htt...
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
Timeline
Published28 Jan 2022
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4m8h-h59m-m34j · GHSA
CVE-2021-23558 · NVD
Track software like this
Free during beta