CVE-2024-38998

requirejs: prototype pollution via config function

View on CVE.org
Published Jul 1, 2024 CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:requirejs:requirejs:*:*:*:*:*:*:*:*
Vendors & Products Requirejs
Requirejs requirejs
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}
Type Values Removed Values Added
CPEs cpe:2.3:a:jrburke:requirejs:2.3.6:*:*:*:*:*:*:*
Vendors & Products Jrburke
Jrburke requirejs
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. NOTE: this is disputed by a third party because it is not plausible that any application would accept untrusted lib.s.contexts._.configure input. DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Type Values Removed Values Added
Description jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. NOTE: this is disputed by a third party because it is not plausible that any application would accept untrusted lib.s.contexts._.configure input.
Type Values Removed Values Added
First Time appeared Requirejs
Requirejs requirejs
CPEs cpe:2.3:a:requirejs:requirejs:*:*:*:*:*:*:*:*
Vendors & Products Requirejs
Requirejs requirejs

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
mitre
Published
Updated
Jan 28, 2025, 7:44 PM
Reserved
Jun 21, 2024, 12:00 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Jul 1, 2024, 1:15 PM
Modified
Jan 28, 2025, 8:15 PM

View source JSON

Severity
Moderate
Public date
Jul 1, 2024, 12:00 AM

View source Bugzilla JSON

No data.