Detections
Analytics

SCA: security update for dynamoose (GHSA-rrqm-p222-8ph2)

critical Tenable Cloud Security Plugin ID 418909

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and
 before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method
 "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout
 Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this
 vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This
 vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this
 vulnerability. (CVE-2021-21304)

See Also

https://github.com/advisories/GHSA-rrqm-p222-8ph2

Plugin Details

Severity: Critical

ID: 418909

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-21304

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/8/2021

Vulnerability Publication Date: 2/8/2021

Reference Information

CVE: CVE-2021-21304