CVE-2021-23807

[CVE catalog]

Severity

High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Published

Aug 31, 2021, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

2.75% · Oct 25, 2026

A Type Confusion vulnerability was found in node-jsonpointer. This issue leads to the bypass of a previous Prototype Pollution fix when the pointer components are arrays. This flaw allows an attacker to use objects of incompatible base types, leading to remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. nodejs-jsonpointer: type confusion vulnerability can lead to a bypass of a previous prototype pollution fix when the pointer components are arrays In Red Hat Quay, JSON pointer is a development dependency, therefore the impact of this flaw is rated Low. A fix may be delivered in future Quay updates. Hadoop-container is affected, but it's deprecated since OpenShift Container Platform 4.6, hence marked as WONTFIX. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.