68 vulnerabilities classified as CWE-915. AI Chinese analysis included.
CWE-915 represents a critical input validation weakness where software fails to restrict which object attributes can be modified based on external input. Attackers typically exploit this by injecting malicious data that targets internal or privileged properties, such as access control flags or system configuration settings, rather than intended user-facing fields. This unauthorized modification can bypass security mechanisms, escalate privileges, or cause denial of service by corrupting the object’s internal state. To prevent this vulnerability, developers must implement strict allow-lists that explicitly define permissible attributes for modification, ensuring that only expected fields are updated. Additionally, employing robust serialization frameworks with built-in validation and conducting thorough code reviews to identify dynamic attribute assignment patterns are essential strategies for mitigating this risk and maintaining application integrity.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2022-2625 | PostgreSQL 安全漏洞 — postgresql | 7.1 | - | 2022-08-18 |
| CVE-2022-31106 | Prototype Pollution in underscore.deep — underscore.deep | 8.3 | High | 2022-06-28 |
| CVE-2022-24802 | Prototype Pollution in deepmerge-ts — deepmerge-ts | 8.1 | High | 2022-03-31 |
| CVE-2021-32811 | Remote Code Execution via Script (Python) objects under Python 3 — Zope | 7.5 | High | 2021-08-02 |
| CVE-2021-32807 | Remote Code Execution via unsafe classes in otherwise permitted modules — AccessControl | 4.4 | Medium | 2021-07-30 |
| CVE-2021-21368 | Prototype poisoning — msgpack5 | 6.7 | Medium | 2021-03-12 |
| CVE-2021-21304 | Prototype Pollution in Dynamoose — dynamoose | 7.2 | High | 2021-02-08 |
| CVE-2020-11066 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS — TYPO3 CMS | 8.7 | High | 2020-05-13 |
Vulnerabilities classified as CWE-915 represent 68 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.