medium5.4
CVE-2021-23408
Prototype Pollution in GraphHopper
Impact
This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.graphhopper:graphhopper-web-bundle | < 3.2 | 3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Graphhopper | Graphhopper | before 3.2 Version 4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/graphhopper/graphhopper/pull/2370
- https://github.com/graphhopper/graphhopper/releases/tag/3.1
- https://github.com/graphhopper/graphhopper/releases/tag/3.2
- https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114
- https://github.com/advisories/GHSA-qhxh-9hhx-6p7v
- https://nvd.nist.gov/vuln/detail/CVE-2021-23408