What’s Vulnerable › Vulnerabilities
CVE-2021-23450: Prototype Pollution
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 30.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-12-17 · updated 2026-10-08
- Weakness: CWE-1321
Description
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Affected products
- Debian Linux: 10.0
- Linuxfoundation Dojo: before 1.17.0 — fixed in 1.17.0
- Oracle Corporation Communications Policy Management: 12.6.0.0.0
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12, 21.12
- Oracle WebLogic Server: 12.2.1.4.0, 14.1.1.0.0
- Npm Dojo: through 1.16.4
How to fix
Upgrade to a fixed version: Linuxfoundation Dojo 1.17.0. Check the vendor advisory for mitigations.
References
- https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172
- https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033
- https://snyk.io/vuln/SNYK-JS-DOJO-1535223
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172
- https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036
Get alerted when CVE-2021-23450 or the next vulnerability affects your stack