PT-2024-28303 · Unknown · Aofl Cli-Lib

Mestrteeo · Published 2024-07-01 · Updated 2024-07-11 · CVE-2024-38987

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions aofl cli-lib version 3.14.0

Description The issue allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties through a prototype pollution in the defaultsDeep component.

Recommendations For aofl cli-lib version 3.14.0, consider restricting the use of the defaultsDeep component until a patch is available to prevent arbitrary code execution or Denial of Service (DoS) attacks.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-38987

GHSA-VG6V-JCG3-5MP7

Affected Products

Aofl Cli-Lib

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-38987 · Security Note
• https://osv.dev/vulnerability/GHSA-vg6v-jcg3-5mp7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38987 · Vendor Advisory
• https://github.com/AgeOfLearning/aofl · Note
• https://github.com/AgeOfLearning/aofl/issues/35 · Note
• https://t.me/cvenotify/84890 · Telegram Post
• https://gist.github.com/mestrtee/29636943e6989e67f38251580cbcea73 · Note
• https://t.me/cvenotify/85845 · Telegram Post
• https://t.me/cvenotify/84910 · Telegram Post