CVE-2021-20083: jquery-plugin-query-object_project jquery-plugin-query-object Prototype Pollution
CVSS: 8.8v3.1HighModified
AliasesGHSA-q9xg-h756-8689
Published 23-04-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-20083 is a high (CVSS 8.8) Prototype Pollution vulnerability in jquery-plugin-query-object_project jquery-plugin-query-object. EPSS estimates a 4.19% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
4.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 23-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · NpmEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.19%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.19% on 19-09-2026
19-09-202619-10-2026
EPSS score4.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundClient Side Prototype Pollution
Maturity: poc
Weaknesses
CWE · root cause- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Jquery-plugin-query-object_project1 product
Npm1 product
- jquery-query-object≤ 2.2.3
Wordpress1 product
- wordpress< 3.7 (fixed in 3.7.38) | ≥ 3.7, ≤ 3.7.37 (fixed in 3.7.38) | ≥ 3.8, ≤ 3.8.37 (fixed in 3.7.38) | ≥ 3.9, ≤ 3.9.35 (fixed in 3.7.38) | ≥ 4.0, ≤ 4.0.34 (fixed in 3.7.38) | ≥ 4.1, ≤ 4.1.34 (fixed in 3.7.38) | ≥ 4.2, ≤ 4.2.31 (fixed in 3.7.38) | ≥ 4.3, ≤ 4.3.27 (fixed in 3.7.38) | ≥ 4.4, ≤ 4.4.26 (fixed in 3.7.38) | ≥ 4.5, ≤ 4.5.25 (fixed in 3.7.38) | ≥ 4.6, ≤ 4.6.22 (fixed in 3.7.38) | ≥ 4.7, ≤ 4.7.22 (fixed in 3.7.38) | ≥ 4.8, ≤ 4.8.18 (fixed in 3.7.38) | ≥ 4.9, ≤ 4.9.19 (fixed in 3.7.38) | ≥ 5.0, ≤ 5.0.15 (fixed in 3.7.38) | ≥ 5.1, ≤ 5.1.12 (fixed in 3.7.38) | ≥ 5.2, ≤ 5.2.14 (fixed in 3.7.38) | ≥ 5.3, ≤ 5.3.11 (fixed in 3.7.38) | ≥ 5.4, ≤ 5.4.9 (fixed in 3.7.38) | ≥ 5.5, ≤ 5.5.8 (fixed in 3.7.38) | ≥ 5.6, ≤ 5.6.7 (fixed in 3.7.38) | ≥ 5.7, ≤ 5.7.5 (fixed in 3.7.38) | ≥ 5.8, ≤ 5.8.3 (fixed in 3.7.38) | ≥ 5.9, ≤ 5.9.1 (fixed in 3.7.38)
3 vendors · 3 products
References
8 links- github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-query-object.mdX Refsource MISCWEBExploitThird Party Advisory
- packetstormsecurity.com/files/166299/WordPress-Core-5.9.0-5.9.1-Cross-Site-Scripting.htmlX Refsource MISCWEBThird Party AdvisoryVDB Entry
