lukebond json-override 0.2.0 __proto__ prototype pollution

Summaryinfo

A vulnerability was found in lukebond json-override 0.2.0. It has been declared as problematic. This impacts the function __proto__. The manipulation results in prototype pollution. This vulnerability is identified as CVE-2024-38984. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in lukebond json-override 0.2.0. Affected is the function __proto__. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.

The advisory is shared for download at gist.github.com. This vulnerability is traded as CVE-2024-38984 since 06/21/2024. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• lukebond

Name

• json-override

Version

• 0.2.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion