PT-2025-5753 · Unknown · Ajax-Request

Published 2025-02-05 · Updated 2025-02-06 · CVE-2024-57076

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ajax-request version 1.2.3

Description: A prototype pollution in the lib.post function allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. This issue can be exploited by providing a manipulated payload to the vulnerable function, leading to a denial of service.

Recommendations: For version 1.2.3, consider disabling the lib.post function as a temporary workaround until a patch is available. Restrict access to the lib.post function to minimize the risk of exploitation. Avoid using the vulnerable function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Prototype Pollution

Weakness Enumeration

CWE-400

CWE-1321

Related Identifiers

CVE-2024-57076

Affected Products

Ajax-Request

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-57076 · Security Note
• https://twitter.com/CVEnew/status/1887254515021172784 · Twitter Post
• https://gist.github.com/tariqhawis/c432b93ee7d967c2e65bc1bf39241664 · Note
• https://twitter.com/VulmonFeeds/status/1887409155733868767 · Twitter Post