Published: 17/03/2022 Updated: 12/04/2022

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Vulnerable Product	Search on Vulmon	Subscribe to Product
substack minimist

Synopsis Moderate: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red ...

Synopsis Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for nodejs and nodejs-nodemon is now available for Red Hat Enterprise Linux 9 ...

Synopsis Moderate: Red Hat OpenShift Service Mesh 2121 containers security update Type/Severity Security Advisory: Moderate Topic An update for is now available for OpenShift Service Mesh 21Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 746 Security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform ...

Synopsis Moderate: Red Hat JBoss Enterprise Application Platform 746 Security update Type/Severity Security Advisory: Moderate Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 74Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...

Synopsis Moderate: rh-nodejs14-nodejs security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-nodejs14-nodejs is now available for Red Hat Software CollectionsRed Hat Product Security has rated th ...

Synopsis Important: Red Hat Single Sign-On 762 for OpenShift image security and enhancement update Type/Severity Security Advisory: Important Topic A new image is available for Red Hat Single Sign-On 762, running on RedHat OpenShift Container Platform from the release of 311 up to the releaseof 4120Red Hat Product Security has rated t ...

Synopsis Important: OpenShift Container Platform 4110 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4110 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...

Synopsis Moderate: nodejs:16 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8Red Hat Product Secu ...

Synopsis Important: nodejs:14 security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 86 Extended Update ...

Synopsis Important: Red Hat Process Automation Manager 7131 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Process Automation ManagerRed Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which gives ...

Synopsis Important: Red Hat Fuse 7111 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 711 to 7111) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security has rated this updat ...

Synopsis Moderate: nodejs:14 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8Red Hat Product Secu ...

Synopsis Moderate: rh-nodejs12-nodejs security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-nodejs12-nodejs is now available for Red Hat Software CollectionsRed Hat Pro ...

概述 Important: Red Hat Single Sign-On 762 security update on RHEL 8 类型/严重性 Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems 标题 New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 8Red H ...

Synopsis Important: Red Hat Single Sign-On 762 security update on RHEL 7 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 7Red Hat ...

Synopsis Important: Red Hat Single Sign-On 762 security update on RHEL 9 Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic New Red Hat Single Sign-On 762 packages are now available for Red Hat Enterprise Linux 9Red Hat ...

Synopsis Important: Red Hat Single Sign-On 762 security update Type/Severity Security Advisory: Important Topic A security update is now available for Red Hat Single Sign-On 76 from the Customer PortalRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base ...

Minimist &lt;=125 is vulnerable to Prototype Pollution via file indexjs, function setKey() (lines 69-95) ...

Toggle Switch Accessory with Local MQTT Server Version History v 106 Patch CVE-2021-44906 : Prototype Pollution in minimist

Water Valve Accessory with Local MQTT Server add new property deviceType 0 : ”Generic valve” 1 : ”Irrigation” 2 : ”Shower head” 3 : ”Water faucet” 4-255 : ”Reserved” topicStatus message format : {"DeviceStatus":"ON"} (or OFF) Version History v 107 Patch CVE-2021-44906 : Prototype Pol

Door Lock Accessory with Local MQTT Server Version History v 107 Patch CVE-2021-44906 : Prototype Pollution in minimist

CVE-2021-44906 Originally from: githubcom/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoCzip Run npm run hack And you will see the any function's done property is changed to true The explanation of command line node indexjs --_concatconstructorprototypedone true: -- is the hypen mark normally used

CWE-1321 https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068 https://github.com/substack/minimist/issues/164 https://github.com/substack/minimist/blob/master/index.js#L69 https://nvd.nist.gov https://github.com/akiifall/homebridge-mqtt-toggleswitch https://access.redhat.com/errata/RHSA-2023:0612 https://access.redhat.com/security/cve/cve-2021-44906

Get Started

CVE-2021-44906

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect