TI-2021-06132 Aliases CVE-2021-23440 GHSA-4jqc-8m5r-9rpr

Prototype pollution in set-value

MEDIUM 46CWE-843Published 2021-09-12 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-843 and the CVSS impact.

Summary

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

Why it matters now

EPSS 0.02206 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial set-value: 2.0.1set-value (npm): 4.0.1, 2.0.1, 3.0.3+1 more productRed Hat: 3 advisoriesRed Hat: 1 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	set-value	before 2.0.1; >=3.0.0 <4.0.1	2.0.1	Patch available	CNA
—	set-value (npm)	4.0.0 to before 4.0.1	4.0.1	Patch available	GHSA-4jqc-8m5r-9rpr
—	set-value-nuget (NuGet)	before 2.0.0	2.0.0	Patch available	GHSA-4jqc-8m5r-9rpr
—	set-value (npm)	before 2.0.1	2.0.1	Patch available	GHSA-4jqc-8m5r-9rpr
—	set-value (npm)	3.0.0 to before 3.0.3	3.0.3	Patch available	GHSA-4jqc-8m5r-9rpr

set-value Vendor— Affected before 2.0.1; >=3.0.0 <4.0.1 Fixed in 2.0.1 Patch available CNA
set-value (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-4jqc-8m5r-9rpr
set-value-nuget (NuGet) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-4jqc-8m5r-9rpr
set-value (npm) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-4jqc-8m5r-9rpr
set-value (npm) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-4jqc-8m5r-9rpr

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:set-value_project:set-value::::::node.js::*	before 2.0.1; 3.0.0 to before 4.0.1	Vulnerable	Set-value Project
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*	1.14.0	Vulnerable	Oracle

cpe:2.3:a:set-value_project:set-value:*:*:*:*:*:node.js:*:* Versions before 2.0.1; 3.0.0 to before 4.0.1 Vulnerable ·Set-value Project
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle

Remediation

Fix · CNA set-value Fixed in 2.0.1
Fix · GHSA-4jqc-8m5r-9rpr set-value (npm) Fixed in 4.0.1 Advisory →
Fix · GHSA-4jqc-8m5r-9rpr set-value-nuget (NuGet) Fixed in 2.0.0 Advisory →
Fix · GHSA-4jqc-8m5r-9rpr set-value (npm) Fixed in 2.0.1 Advisory →
Fix · GHSA-4jqc-8m5r-9rpr set-value (npm) Fixed in 3.0.3 Advisory →

Red Hat 3 advisories

RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
RHSA-2021:5038 Released 2021-12-09 · Red Hat rating Low
Red Hat Advanced Cluster Management 2.2.10 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
RHSA-2021:3873 Released 2021-10-14 · Red Hat rating Important
Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Logging Subsystem for Red Hat OpenShift	Affected	No fix planned: Will not fix
OpenShift Service Mesh 1	Affected	No fix planned: Out of support scope
OpenShift Service Mesh 2.0	Affected	No fix yet
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Out of support scope
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift distributed tracing 2	Affected	No fix planned: Will not fix
Red Hat Openshift Container Storage 4	Affected	No fix planned: Out of support scope
Red Hat Quay 3	Affected	No fix planned: Will not fix
RHODF 4.11 for RHEL 8	Fixed	RHSA-2022:6156

Not affected: 3 products

Migration Toolkit for Virtualization
RHODF 4.11 for RHEL 8
Red Hat Advanced Cluster Management for Kubernetes 2

Timeline

2026-10-02 Threatist record created from CVE-2021-23440
2026-10-03 Alias added: GHSA-4jqc-8m5r-9rpr

References

Exploit 1

https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-23440

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences