A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was published 12/25/2022 as a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2021-4278. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 0.7.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch a63f559c50d70e8cb2eaae670dec25d1dbc4afcd is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• cronvel

Name

• tree-kit

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion