CVE-2024-39001 - OpenCVE

ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Ag-grid	Ag-grid-enterprise

No data.

No data.

References

Link	Providers
https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-07-01T00:00:00

Updated: 2024-08-02T04:19:20.486Z

Reserved: 2024-06-21T00:00:00

Link: CVE-2024-39001

Vulnrichment

Updated: 2024-07-10T16:26:59.788Z

NVD

Status : Awaiting Analysis

Published: 2024-07-01T13:15:05.397

Modified: 2024-07-11T15:06:05.870

Link: CVE-2024-39001

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-39001", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T04:19:20.486Z", "dateReserved": "2024-06-21T00:00:00", "datePublished": "2024-07-01T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-01T12:49:21.916313"}, "descriptions": [{"lang": "en", "value": "ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b"}, {"url": "https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b"}, {"url": "https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "affected": [{"vendor": "ag-grid", "product": "ag-grid-enterprise", "cpes": ["cpe:2.3:a:ag-grid:ag-grid-enterprise:31.3.2:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "31.3.2", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-10T16:25:18.721092Z", "id": "CVE-2024-39001", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T16:27:05.203Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:19:20.486Z"}, "title": "CVE Program Container", "references": [{"url": "https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-39001", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-10T16:25:18.721092Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ag-grid:ag-grid-enterprise:31.3.2:*:*:*:*:*:*:*"], "vendor": "ag-grid", "product": "ag-grid-enterprise", "versions": [{"status": "affected", "version": "31.3.2"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T16:26:59.788Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b"}, {"url": "https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b"}, {"url": "https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa"}], "descriptions": [{"lang": "en", "value": "ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-01T12:49:21.916313"}}}, "cveMetadata": {"cveId": "CVE-2024-39001", "state": "PUBLISHED", "dateUpdated": "2024-07-10T16:27:05.203Z", "dateReserved": "2024-06-21T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-07-01T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}