CVE-2021-43852 json
JavaScript Prototype Pollution in oro/platform
published 2022-01-04 4 y ago modified 2026-07-08 4 mo ago also GHSA-jx5q-g37m-h5hj , EUVD-2022-0639
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.
Patch / fix
- packagist oro/platform 4.1.14, 4.2.8
- oroinc oroplatform 4.1.14, 4.2.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | oro/platform | >=4.1.0, <4.1.14 >=4.2.0, <4.2.8 |
4.1.14 4.2.8 |
Affected products
- oroinc platform
Classification
References
-
github.com
/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9
web, patch, third-party-advisory
-
github.com
/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hj
web, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-43852
advisory
-
github.com
/oroinc/platform
package
Sources
- CVE List CVE-2021-43852
- GitHub Advisory GHSA-jx5q-g37m-h5hj
- NVD CVE-2021-43852
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.