PT-2024-28307 · Unknown · Akbr Patch-Into

Mestrtee · Published 2024-07-01 · Updated 2024-07-04 · CVE-2024-38991

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions akbr patch-into version 1.0.1

Description The issue is related to a prototype pollution via the function patchInto(). This allows attackers to execute arbitrary code or cause a Denial of Service (DoS) by injecting arbitrary properties.

Recommendations For version 1.0.1, consider disabling the patchInto() function as a temporary workaround until a patch is available.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-38991

GHSA-GH4X-QV3P-M9PM

Affected Products

Akbr Patch-Into

References · 6

• https://osv.dev/vulnerability/GHSA-gh4x-qv3p-m9pm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38991 · Security Note
• https://gist.github.com/mestrtee/8851413e3b33a96f191f0e9c81706532 · Note
• https://t.me/cvenotify/84892 · Telegram Post
• https://twitter.com/cracbot/status/1809105028592120130 · Twitter Post
• https://t.me/cvenotify/84912 · Telegram Post