CVE-2024-38999

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Prototype Pollution
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Debian logo
Debian Releases
Debian Product
Codename
requirejs
bullseye
no-dsa
bookworm
no-dsa
sid
2.3.7+ds+~2.1.37-1
fixed
trixie
2.3.7+ds+~2.1.37-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
requirejs
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
mantic
ignored
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a