Prototype pollution in zrender - CVE-2021-39227

Vulnerability identifier: #VU82314

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39227

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

zrender
Jira Service Management Data Center
Jira Service Management Server
Jira Software Data Center
QRadar User Behavior Analytics
Jira Software Server

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

zrender - update to 5.2.1
Jira Service Management Data Center - addressed in versions 10.3.14, 11.3.0
Jira Service Management Server - addressed in versions 10.3.14, 11.3.0
Jira Software Data Center - addressed in versions 10.3.14, 11.3.0
Jira Software Server - addressed in versions 10.3.14, 11.3.0
QRadar User Behavior Analytics - update to 4.1.11

• https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf
• https://github.com/ecomfe/zrender/pull/826
• https://github.com/ecomfe/zrender/releases/tag/5.2.1

• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Jira Software Data Center and Server update for zrender
• Jira Service Management Data Center and Server update for zrender