CVE-2021-23440: oracle communications_cloud_native_core_policy Type Confusion
Vulnerability summary
CVE-2021-23440 is a critical (CVSS 9.8) Type Confusion vulnerability in oracle communications_cloud_native_core_policy. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 12-09-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · NugetEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.21% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- node-set-value< 3.0.1-3
Npm1 product
- set-value≥ 4.0.0, < 4.0.1 | < 2.0.1 | ≥ 3.0.0, < 3.0.3
NuGet1 product
- set-value-nuget< 2.0.0
Oracle1 product
Set-value_project1 product
- set-value< 2.0.1 | ≥ 3.0.0, < 4.0.1
Ubuntu1 product
- node-set-valueAll versions (No fix recorded)
6 vendors · 6 products
References
15 links- github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452X Refsource MISCREPORTWEBPatchThird Party Advisory
- www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/X Refsource MISCREPORTExploitThird Party Advisory
