{"id":"CVE-2021-23450","title":"All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.","summary":"All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1321"],"vendor":"linuxfoundation","product":"dojo","affected":["dojo < 1.17.0","communications_policy_management = 12.6.0.0.0","primavera_unifier >= 17.7, <= 17.12","primavera_unifier = 18.8","primavera_unifier = 19.12","primavera_unifier = 20.12","primavera_unifier = 21.12","weblogic_server = 12.2.1.4.0","weblogic_server = 14.1.1.0.0","debian_linux = 10.0"],"patched":["dojo 1.17.0"],"published":"2021-12-17","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:08.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-23450","references":[{"url":"https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172","label":"report@snyk.io"},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JS-DOJO-1535223","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"report@snyk.io"},{"url":"https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-DOJO-1535223","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.30367,"epssPercentile":0.98193,"ingestedAt":"2026-10-08T23:16:47.327Z","slug":"CVE-2021-23450","body":"## Overview\n\nAll versions of package dojo are vulnerable to Prototype Pollution via the setObject function.\n\n## Affected\n\n- `dojo < 1.17.0`\n- `communications_policy_management = 12.6.0.0.0`\n- `primavera_unifier >= 17.7, <= 17.12`\n- `primavera_unifier = 18.8`\n- `primavera_unifier = 19.12`\n- `primavera_unifier = 20.12`\n- `primavera_unifier = 21.12`\n- `weblogic_server = 12.2.1.4.0`\n- `weblogic_server = 14.1.1.0.0`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `dojo 1.17.0`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":41.3,"likelihood":6.1,"exploitation":0,"ransomware":0},"changes":[]}