Prototype pollution in immer - CVE-2021-3757,CVE-2020-28477

Vulnerability identifier: #VU57215

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3757,CVE-2020-28477

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request to the application and perform prototype pollution.

immer
SUSE Linux Enterprise Module for SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
IBM Edge Application Manager
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
IBM Business Automation Manager Open Editions
prometheus-formula
grafana-formula
prometheus-exporters-formula
subscription-matcher
xpp3
xpp3-minimal
xstream
smdba
cobbler
python3-rhnlib
spacewalk-proxy-salt
spacewalk-proxy-broker
spacewalk-proxy-common
spacewalk-proxy-management
spacewalk-proxy-package-manager
spacewalk-proxy-redirect
python3-mgr-osa-dispatcher
python3-mgr-osa-common
mgr-osa-dispatcher
python3-mgr-osad
mgr-osad
spacewalk-config
spacewalk-proxy-installer
mgr-libmod
spacewalk-client-setup
spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-check
spacewalk-client-tools
python3-spacewalk-client-tools
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
spacewalk-utils-extras
spacewalk-utils
susemanager-schema
susemanager-sls
uyuni-config-modules
spacewalk-backend-iss-export
spacewalk-backend-package-push-server
spacewalk-backend-server
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
spacewalk-backend
spacewalk-backend-xmlrpc
spacewalk-backend-sql-postgresql
spacewalk-backend-tools
spacewalk-backend-xml-export-libs
spacewalk-html
susemanager-web-libs
spacewalk-base-minimal-config
spacewalk-base-minimal
spacewalk-base
susemanager
susemanager-tools
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-lib
spacewalk-java-config
spacewalk-java
py26-compat-salt

Install updates from vendor's website.

immer - update to 8.0.1
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
IBM Business Automation Manager Open Editions - update to 8.0.1
prometheus-formula - update to 0.3.1-3.6.2
grafana-formula - update to 0.4.0-3.6.2
prometheus-exporters-formula - update to 0.9.0-3.19.2
subscription-matcher - update to 0.26-3.6.2
xpp3 - update to 1.1.4c-11.2.2
xpp3-minimal - update to 1.1.4c-11.2.2
xstream - update to 1.4.15-3.5.2
smdba - update to 1.7.8-0.3.6.2
cobbler - update to 3.0.0+git20190806.32c4bae0-5.6.4
python3-rhnlib - update to 4.1.3-4.3.2
spacewalk-proxy-salt - update to 4.1.4-3.9.4
spacewalk-proxy-broker - update to 4.1.4-3.9.4
spacewalk-proxy-common - update to 4.1.4-3.9.4
spacewalk-proxy-management - update to 4.1.4-3.9.4
spacewalk-proxy-package-manager - update to 4.1.4-3.9.4
spacewalk-proxy-redirect - update to 4.1.4-3.9.4
python3-mgr-osa-dispatcher - update to 4.1.5-2.9.4
python3-mgr-osa-common - update to 4.1.5-2.9.4
mgr-osa-dispatcher - update to 4.1.5-2.9.4
python3-mgr-osad - update to 4.1.5-2.9.4
mgr-osad - update to 4.1.5-2.9.4
spacewalk-config - update to 4.1.5-3.3.2
spacewalk-proxy-installer - update to 4.1.6-3.3.2
mgr-libmod - update to 4.1.7-3.16.2
spacewalk-client-setup - update to 4.1.9-4.12.4
spacewalk-check - update to 4.1.9-4.12.4
python3-spacewalk-client-setup - update to 4.1.9-4.12.4
python3-spacewalk-check - update to 4.1.9-4.12.4
spacewalk-client-tools - update to 4.1.9-4.12.4
python3-spacewalk-client-tools - update to 4.1.9-4.12.4
susemanager-docs_en-pdf - update to 4.1-11.28.2
susemanager-docs_en - update to 4.1-11.28.2
susemanager-doc-indexes - update to 4.1-11.28.4
spacewalk-utils-extras - update to 4.1.14-3.12.2
spacewalk-utils - update to 4.1.14-3.12.2
susemanager-schema - update to 4.1.19-3.24.4
susemanager-sls - update to 4.1.21-3.26.2
uyuni-config-modules - update to 4.1.21-3.26.2
spacewalk-backend-iss-export - update to 4.1.21-4.22.7
spacewalk-backend-package-push-server - update to 4.1.21-4.22.7
spacewalk-backend-server - update to 4.1.21-4.22.7
spacewalk-backend-sql - update to 4.1.21-4.22.7
spacewalk-backend-iss - update to 4.1.21-4.22.7
spacewalk-backend-config-files-tool - update to 4.1.21-4.22.7
spacewalk-backend-config-files-common - update to 4.1.21-4.22.7
spacewalk-backend-config-files - update to 4.1.21-4.22.7
spacewalk-backend-applet - update to 4.1.21-4.22.7
spacewalk-backend-app - update to 4.1.21-4.22.7
spacewalk-backend - update to 4.1.21-4.22.7
spacewalk-backend-xmlrpc - update to 4.1.21-4.22.7
spacewalk-backend-sql-postgresql - update to 4.1.21-4.22.7
spacewalk-backend-tools - update to 4.1.21-4.22.7
spacewalk-backend-xml-export-libs - update to 4.1.21-4.22.7
spacewalk-html - update to 4.1.23-3.18.6
susemanager-web-libs - update to 4.1.23-3.18.6
spacewalk-base-minimal-config - update to 4.1.23-3.18.6
spacewalk-base-minimal - update to 4.1.23-3.18.6
spacewalk-base - update to 4.1.23-3.18.6
susemanager - update to 4.1.24-3.20.2
susemanager-tools - update to 4.1.24-3.20.2
spacewalk-taskomatic - update to 4.1.30-3.31.7
spacewalk-java-postgresql - update to 4.1.30-3.31.7
spacewalk-java-lib - update to 4.1.30-3.31.7
spacewalk-java-config - update to 4.1.30-3.31.7
spacewalk-java - update to 4.1.30-3.31.7
py26-compat-salt - update to 2016.11.10-6.11.2

• https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213
• https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/
• https://github.com/immerjs/immer/releases/tag/v8.0.1

• Prototype pollution in immer
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• SUSE update for SUSE Manager Server 4.1
• Multiple vulnerabilities in IBM Edge Application Manager