PT-2024-28306 · Tada5Hi · Sp-Common
CVE-2024-38990
·
Published
2024-07-01
·
Updated
2024-07-03
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Tada5hi sp-common version 0.5.4
Description
The issue allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties through a prototype pollution vulnerability in the
mergeDeep function.Recommendations
For Tada5hi sp-common version 0.5.4, consider disabling the
mergeDeep function as a temporary workaround until a patch is available. Restrict access to the mergeDeep function to minimize the risk of exploitation.Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sp-Common