CVE-2021-23682

HIGH

appwrite < 0.11.1 and 0.12.0-0.12.2 - Prototype Pollution via Query String Parsing

Title source: llm
STIX 2.1

Description

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

References (6)

Core 6
Core References
Exploit, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250
Exploit, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820
Patch, Third Party Advisory x_refsource_misc
https://github.com/litespeed-js/litespeed.js/pull/18
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/appwrite/appwrite/releases/tag/0.12.2
Patch, Third Party Advisory x_refsource_misc
https://github.com/appwrite/appwrite/pull/2778
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/appwrite/appwrite/releases/tag/0.11.1

Scores

CVSS v3 7.3
EPSS 0.0209
EPSS Percentile 79.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-1321
Status published
Products (4)
appwrite/appwrite < 0.11.1
appwrite/server-ce 0.12.0 - 0.12.2Packagist
litespeed.js_project/litespeed.js < 0.3.12
npm/litespeed.js 0 - 0.3.12npm
Published Feb 16, 2022
Tracked Since Feb 18, 2026