CVE-2024-34391

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada libxmljs project libxmljs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).

Rincian

Terbit di NVD

2 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ exploit · advisory pihak ketiga
• https://github.com/libxmljs/libxmljs/issues/645 exploit · issue tracking