search

rsoreq / terragoat

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
https://www.bridgecrew.io/
Apache License 2.0
0 stars 0 forks source link

requirejs-2.3.6.tgz: 2 vulnerabilities (highest severity is: 9.3) #9

Open mend-for-github-com[bot] opened 5 days ago

mend-for-github-com[bot] commented 5 days ago
Vulnerable Library - requirejs-2.3.6.tgz

Node adapter for RequireJS, for loading AMD modules. Includes RequireJS optimizer

Library home page: https://registry.npmjs.org/requirejs/-/requirejs-2.3.6.tgz

Path to dependency file: /packages/node/base/package.json

Path to vulnerable library: /packages/node/base/node_modules/requirejs/package.json

Found in HEAD commit: d42725f4065c555d9b0a227fdb42ad5e87b8d984

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (requirejs version) Remediation Possible** Reachability
CVE-2024-38998 Critical 9.3 Not Defined 0.1% requirejs-2.3.6.tgz Direct N/A ❌
CVE-2024-38999 High 8.9 Not Defined 0.0% requirejs-2.3.6.tgz Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-38998 ### Vulnerable Library - requirejs-2.3.6.tgz

Node adapter for RequireJS, for loading AMD modules. Includes RequireJS optimizer

Library home page: https://registry.npmjs.org/requirejs/-/requirejs-2.3.6.tgz

Path to dependency file: /packages/node/base/package.json

Path to vulnerable library: /packages/node/base/node_modules/requirejs/package.json

Dependency Hierarchy: - :x: **requirejs-2.3.6.tgz** (Vulnerable Library)

Found in HEAD commit: d42725f4065c555d9b0a227fdb42ad5e87b8d984

Found in base branch: master

### Vulnerability Details

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Publish Date: 2024-07-01

URL: CVE-2024-38998

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 4 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

CVE-2024-38999 ### Vulnerable Library - requirejs-2.3.6.tgz

Node adapter for RequireJS, for loading AMD modules. Includes RequireJS optimizer

Library home page: https://registry.npmjs.org/requirejs/-/requirejs-2.3.6.tgz

Path to dependency file: /packages/node/base/package.json

Path to vulnerable library: /packages/node/base/node_modules/requirejs/package.json

Dependency Hierarchy: - :x: **requirejs-2.3.6.tgz** (Vulnerable Library)

Found in HEAD commit: d42725f4065c555d9b0a227fdb42ad5e87b8d984

Found in base branch: master

### Vulnerability Details

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Publish Date: 2024-07-01

URL: CVE-2024-38999

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 4 Score Details (8.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.