CVE-2024-36572
CRITICAL 9.8EPSS 0.7%
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.65% chance of exploitation in the next 30 days, 50th percentile
- Published
- 2024-07-30
- Updated
- 2024-08-02
Proof-of-concept exploits (2)
- https://gist.github.com/mestrtee/1771ab4fba733ca898b6e2463dc6ed19
- allpro/form-manager/issues/110★ · 2024-04-23