Description (CNA)
This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / com.graphhopper:graphhopper-web-bundle | affected unspecified before 3.2; affected 4.0-pre1 before unspecified; affected unspecified before 4.0 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114
- https://github.com/graphhopper/graphhopper/pull/2370
- https://github.com/graphhopper/graphhopper/releases/tag/3.2
- https://github.com/graphhopper/graphhopper/releases/tag/3.1
ADP enrichment
No English description supplied.