PT-2023-8585 · Unknown · Cronvel Tree-Kit
Peter Samarin
·
Publicado
2023-08-16
·
Atualizado
2023-12-26
·
CVE-2023-38894
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cronvel Tree-kit versions 0.7.4 and before
Description
A Prototype Pollution issue in Cronvel Tree-kit allows a remote attacker to execute arbitrary code via the
extend function. This issue is related to uncontrolled modification of object prototype attributes. Exploitation of this issue may allow a remote attacker to execute arbitrary code.Recommendations
For Cronvel Tree-kit versions 0.7.4 and before, consider disabling the
extend function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cronvel Tree-Kit