CVE-2021-43852: JavaScript Prototype Pollution in oro/platform

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-04 · updated 2026-06-17
Weakness: CWE-74

Description

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.

Affected products

oroinc platform: from 4.1.0 before 4.1.14; from 4.2.0 before 4.2.8 — fixed in 4.1.14, 4.2.8

How to fix

Upgrade to a fixed version: oroinc platform 4.1.14, 4.2.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43852 or the next vulnerability affects your stack