2o3t-utility 0.1.2 extend prototype pollution

Summaryinfo

A vulnerability classified as problematic has been found in 2o3t-utility 0.1.2. This impacts the function extend. The manipulation leads to prototype pollution. This vulnerability is traded as CVE-2024-39013. There is no exploit available.

Detailsinfo

A vulnerability was found in 2o3t-utility 0.1.2 and classified as problematic. This issue affects the function extend. The manipulation with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

It is possible to read the advisory at gist.github.com. The identification of this vulnerability is CVE-2024-39013 since 06/21/2024. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• 2o3t-utility

Version

• 0.1.2

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion