Prototype pollution in uPlot - CVE-2024-21489
Published: October 14, 2024
Vulnerability identifier: #VU98525
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21489
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation within the uplot.assign() function. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
Affected software
uPlot
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
grafana (Red Hat package)
IBM Security QRadar Log Management AQL Plugin
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
grafana (Red Hat package)
IBM Security QRadar Log Management AQL Plugin
How to mitigate CVE-2024-21489
Install update from vendor's website.
uPlot - update to 1.6.31
IBM Security QRadar Log Management AQL Plugin - update to 1.1.1
grafana (Red Hat package) - update to 7.3.6-7.el8_4
IBM Security QRadar Log Management AQL Plugin - update to 1.1.1
grafana (Red Hat package) - update to 7.3.6-7.el8_4