Status: Received - Last modified: 27-11-2024 Published: 26-11-2024
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still, a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. This issue affects Convict: before 6.2.4.
EPSS
0.00043
EPSS %
0.10702
0.00043
CWE-1321
0.00043
134c704f-9b21-4f2e-91b3-4a467353bcc0
Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stay updated with real-time CVE vulnerabilities and take action to secure your systems. Enhance your cybersecurity posture with the latest threat intelligence and mitigation techniques. Develop the skills necessary to defend against CVEs and secure critical infrastructures. Advance your expertise with certifications like Certified Ethical Hacker (CEH) and CISSP ISC2. These certifications equip you with proactive strategies to address vulnerabilities and strengthen your organization's defenses against emerging cyber threats. Gain the tools and certifications to stay ahead of evolving CVE threats.
Join the top cybersecurity professionals safeguarding today's infrastructures.