Prototype pollution in requirejs - CVE-2024-38999

Vulnerability identifier: #VU97244

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2024-38999

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
requirejs
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
openEuler
Splunk DB Connect
Oracle Enterprise Data Quality
IBM Watson Discovery for IBM Cloud Pak for Data
Bitbucket Data Center
Moodle
Oracle Business Process Management Suite
Oracle Business Activity Monitoring
Oracle Business Intelligence Enterprise Edition
Cognos Dashboards on Cloud Pak for Data
Business Automation Insights
Planning Analytics Local
nodejs-requirejs
pgadmin4-web-uwsgi
pgadmin4
pgadmin4-cloud
pgadmin4-doc
system-user-pgadmin
pgadmin4-desktop
HPE Unified OSS Console (UOC)
Bitbucket Server

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to prototype pollution via the function s.contexts._.configure. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Install update from vendor's website.

• https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a