CVE-2024-21489 HIGH

CVE-2024-21489

Vendor N/A

Product uplot

Weakness CWE-1321

Published October 1, 2024

Last update October 7, 2024

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P

What the vulnerability does

01Description

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

Key dates

02Disclosure timeline

October 1, 2024 CVE published

October 7, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-21489 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1321.html