This CVE has been withdrawn by MITRE

MITRE marked CVE-2021-29491 as REJECTED on March 14, 2022. It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.

Reason given by MITRE

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

→ See the replacement:CVE-2021-28860

CVE-2021-29491

✕ Withdrawn — historical dataHIGHPre-NVD 7.1

7.1CVSS

Use of Potentially Dangerous Function in mixme

Impact

In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

Patches

The problem is corrected starting with version 0.5.1.

References

Issue: https://github.com/adaltas/node-mixme/issues/1 Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028

CVSS v3: 7.1
EchelonGraph score: Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB: —
EPSS %ILE: —
KEV: —Not applicable: this CVE ID was withdrawn

Published

May 6, 2021

Last Modified

May 6, 2021

Frequently asked(4)

What is CVE-2021-29491?

CVE-2021-29491 is a rejected CVE ID: its record was withdrawn on March 14, 2022 and no longer describes a vulnerability. Reason given: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Its record names CVE-2021-28860 as the replacement.

When was the CVE record for CVE-2021-29491 published?

The CVE record for CVE-2021-29491 was published on May 6, 2021. EchelonGraph's copy of the record carries a last-modified date of May 6, 2021; the record at its source may have been updated since.

What is the CVSS score of CVE-2021-29491?

CVE-2021-29491 has a CVSS base score of 7.1 (the CNA's own assessment, by github_m; NVD's own analysis pending).

How do I remediate CVE-2021-29491?

There is nothing to remediate under CVE-2021-29491: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability. Its record names CVE-2021-28860 as the replacement; act on that CVE instead.