CVE-2024-38999: Critical severity npm/requirejs vulnerability
jrburke requirejs could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the function s.contexts..configure. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
Other sources
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts..configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
— GitHub
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts..configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38999?
CVE-2024-38999 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-38999?
To fix CVE-2024-38999, upgrade requirejs to version 2.3.7 or later.
Which software is affected by CVE-2024-38999?
CVE-2024-38999 affects requirejs version 2.3.6 and earlier, as well as IBM Planning Analytics versions up to 2.1.
What type of vulnerability is CVE-2024-38999?
CVE-2024-38999 is a prototype pollution vulnerability that allows for arbitrary code execution.
Can CVE-2024-38999 cause denial of service attacks?
Yes, CVE-2024-38999 can be exploited to cause denial of service as well as execute arbitrary code.