CVE-2024-39012: Critical severity ais strategyen vulnerability

Published Jul 30, 2024

Updated

ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Affected Software

1 affected component

AIS strategyen=0.4.0

Event History

Jul 30, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates the issue is remotely exploitable over the network, requires no privileges, and does not require user interaction. Exploitation is rated low complexity.

What is the potential impact of a successful exploit?

An attacker may inject arbitrary properties through mergeObjects, potentially leading to arbitrary code execution or denial of service. Confidentiality, integrity, and availability are all rated high impact in the CVSS vector.

CVE-2024-39012: Critical severity ais strategyen vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact of a successful exploit?