PT-2025-5751 · Xe-Utils · Xe-Utils

Published 2025-02-05 · Updated 2025-02-06 · CVE-2024-57074

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: xe-utils version 3.5.31

Description: A prototype pollution in the lib.merge function allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Recommendations: For version 3.5.31, consider disabling the lib.merge function as a temporary workaround until a patch is available. Restrict access to the lib.merge function to minimize the risk of exploitation. Avoid using the lib.merge function in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Prototype Pollution

Weakness Enumeration

CWE-400

CWE-1321

Related Identifiers

CVE-2024-57074

Affected Products

Xe-Utils

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-57074 · Security Note
• https://twitter.com/CVEnew/status/1887254513066672558 · Twitter Post
• https://t.me/cvenotify/110256 · Telegram Post
• https://twitter.com/CVETracker/status/1887592430486057286 · Twitter Post
• https://gist.github.com/tariqhawis/82e3eb472d03273a74e40242e8356297 · Note