PT-2024-28324 · Unknown · Cahil/Utils

Mestrtee · Published 2024-07-01 · Updated 2024-08-21 · CVE-2024-39014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cahil/utils version 2.3.2

Description The issue allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties using the set function. This is a result of prototype pollution in the cahil/utils library.

Recommendations For version 2.3.2, consider disabling the set function as a temporary workaround until a patch is available. Restrict access to the library to minimize the risk of exploitation. Avoid using the library until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-39014

Affected Products

Cahil/Utils

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-39014 · Security Note
• https://gist.github.com/mestrtee/0501db31c1a6864a169e47097f26ac57 · Note
• https://t.me/cvenotify/84906 · Telegram Post
• https://t.me/cvenotify/91622 · Telegram Post