TI-2021-19658 Aliases CVE-2021-43852 GHSA-jx5q-g37m-h5hj

JavaScript Prototype Pollution in oro/platform

MEDIUM 40CWE-74Published 2022-01-04 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0113 66th percentileScored 2026-11-07

Fix Fixed platform (oroinc): 4.2.8oro/platform (Packagist): 4.1.14, 4.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
oroinc	platform	before 4.2.8	4.2.8	Patch available	CNA
—	oro/platform (Packagist)	4.1.0 to before 4.1.14	4.1.14	Patch available	GHSA-jx5q-g37m-h5hj
—	oro/platform (Packagist)	4.2.0 to before 4.2.8	4.2.8	Patch available	GHSA-jx5q-g37m-h5hj

platform Vendororoinc Affected before 4.2.8 Fixed in 4.2.8 Patch available CNA
oro/platform (Packagist) Vendor— Affected 4.1.0 to before 4.1.14 Fixed in 4.1.14 Patch available GHSA-jx5q-g37m-h5hj
oro/platform (Packagist) Vendor— Affected 4.2.0 to before 4.2.8 Fixed in 4.2.8 Patch available GHSA-jx5q-g37m-h5hj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oroinc:oroplatform::::::::	4.1.0 to before 4.1.14; 4.2.0 to before 4.2.8	Vulnerable	oroinc

cpe:2.3:a:oroinc:oroplatform:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.1.14; 4.2.0 to before 4.2.8 Vulnerable ·oroinc

Remediation

Fix · CNA platform (oroinc) Fixed in 4.2.8
Fix · GHSA-jx5q-g37m-h5hj oro/platform (Packagist) Fixed in 4.1.14 Advisory →
Fix · GHSA-jx5q-g37m-h5hj oro/platform (Packagist) Fixed in 4.2.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43852
2026-10-03 Alias added: GHSA-jx5q-g37m-h5hj

References

Patch 1

https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9

Advisory 2

Other 1

https://github.com/oroinc/platform

TI-2024-34079 A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to… CVSS 3.1MEDIUM 6.1
TI-2022-20292 OroPlatform vulnerable to path traversal during temporary file manipulations CVSS 3.1CRITICAL 9.8
TI-2021-18073 XSS vulnerability in oro/platform CVSS 3.1MEDIUM 6.9
TI-2023-15366 OroCalendarBundle has incorrect system calendar events visibility CVSS 3.1MEDIUM 5.0
TI-2023-26159 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID CVSS 3.1MEDIUM 4.3
TI-2023-24584 OroPlatform's pinned entity creation form shows pages of other users CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences