CVE-2024-48910 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M	CNA	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 64%

Vendor	Product	Version
cure53	dompurify	𝑥 < 2.4.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

cacti

bullseye	vulnerable
bullseye (security)	1.2.16+ds1-2+deb11u5 fixed
bookworm	1.2.24+ds1-1+deb12u5 fixed
bookworm (security)	1.2.24+ds1-1+deb12u5 fixed
forky	1.2.30+ds1-1 fixed
sid	1.2.30+ds1-1 fixed
trixie	1.2.30+ds1-1 fixed

node-dompurify

bookworm	2.4.1+dfsg+~2.4.0-2+deb12u1 fixed
bookworm (security)	vulnerable
forky	3.1.7+dfsg+~3.0.5-2 fixed
sid	3.1.7+dfsg+~3.0.5-2 fixed
trixie	3.1.7+dfsg+~3.0.5-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

node-dompurify

questing	not-affected
plucky	not-affected
oracular	not-affected
noble	not-affected
jammy	needs-triage
focal	dne

Common Weakness Enumeration

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References

https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr

https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html