CVE-2024-21529: High severity IBM Watson Studio on Cloud Pak for Data vulnerability
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/dsetto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
dsetto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21529?
CVE-2024-21529 is classified as a high severity vulnerability due to its potential impact on application integrity.
How do I fix CVE-2024-21529?
To fix CVE-2024-21529, upgrade the dset package to version 3.1.4 or later.
What types of attacks can be executed due to CVE-2024-21529?
CVE-2024-21529 allows an attacker to perform prototype pollution, which can lead to unexpected behavior in JavaScript applications.
Which versions of dset are affected by CVE-2024-21529?
All versions of the dset package before 3.1.4 are affected by CVE-2024-21529.
Is user input sanitization a factor in CVE-2024-21529?
Yes, CVE-2024-21529 arises from improper user input sanitization allowing prototype pollution.