Weakness · CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
Official CWE name. Full definition on cwe.mitre.org
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- CM-6Configuration SettingsConfiguration Management · mitigates 6 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 6 techniques
- AC-3Access EnforcementAccess Control · mitigates 5 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 5 techniques
- SI-10Information Input ValidationSystem and Information Integrity · mitigates 5 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 5 techniques
- SI-7Software, Firmware, and Information IntegritySystem and Information Integrity · mitigates 5 techniques
- AC-6Least PrivilegeAccess Control · mitigates 4 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 4 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.