title: Prototype Pollution
description: This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
problem types: Prototype Pollution
affected:
{
product: litespeed.js
vendor: n/a
versions:
lessThan: 0.3.12, status: affected, version: unspecified, versionType: custom
}
{
product: appwrite/server-ce
vendor: n/a
versions:
lessThan: unspecified, status: affected, version: 0.12.0, versionType: custom
lessThan: 0.12.2, status: affected, version: unspecified, versionType: custom
lessThan: 0.11.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
]