PT-2025-13571 · Cool-Path+1 · Cool-Path+1
CVE-2024-38985
·
Publicado
2025-03-28
·
Atualizado
2025-04-01
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
janryWang depath version 1.0.6
janryWang cool-path version 1.1.2
Description
The vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. This is achieved through a prototype pollution via the
set() method at setIn (lib/index.js:90).Recommendations
For janryWang depath version 1.0.6, consider disabling the
setIn function in lib/index.js until a patch is available.
For janryWang cool-path version 1.1.2, restrict access to the setIn function in lib/index.js to minimize the risk of exploitation.Exploit
Correção
DoS
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cool-Path
Depath