cve/2021/CVE-2021-23444.md

CVE-2021-23444

Description

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816
• https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578

Github

• https://github.com/dellalibera/dellalibera