What is CVE-2024-21505?

CVE-2024-21505 is a high-severity vulnerability in Web3-Utils, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2024-03-25.

How severe is CVE-2024-21505?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2024-21505 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Prototype Pollution in Web3-Utils

CVE-2024-21505

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.

Vulnerability class: Prototype Pollution

EPSS: 0.007 (49.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

N/a Web3-utils — versions 0

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-21505?: CVE-2024-21505 is a high-severity vulnerability in Web3-Utils, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2024-03-25.
How severe is CVE-2024-21505?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-21505 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.