PT-2024-27077 · Unknown · Akbr Update

Mestrtee · Published 2024-06-17 · Updated 2024-07-03 · CVE-2024-36578

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions akbr update version 1.0.0

Description The issue is related to Prototype Pollution, which occurs via the update/index.js file.

Recommendations For akbr update version 1.0.0, consider restricting access to the update/index.js file as a temporary mitigation measure until a patch is available.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-36578

GHSA-MJ4P-GMHR-92G3

Affected Products

Akbr Update

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-36578 · Security Note
• https://osv.dev/vulnerability/GHSA-mj4p-gmhr-92g3 · Vendor Advisory
• https://gist.github.com/mestrtee/8bc749ec2b5453d887b2f4a362a65897 · Note
• https://github.com/akbr/update · Note