CVE-2021-43852

HIGH
Published Jan 4, 20224y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jan 4, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-1321
CWE-74

Affected Products 2

VendorProductVersionRange
oroincoroplatform*≥4.1.0  –  <4.1.14
oroincoroplatform*≥4.2.0  –  <4.2.8

References 2

  • github.com https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9
    PatchThird Party Advisory
  • github.com https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hj
    MitigationThird Party Advisory

Remediation

  • github.com https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9
    PatchThird Party Advisory