Vulnerability Details CVE-2024-38996
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.2%
CVSS Severity
CVSS v3 Score 9.8
References
- https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
- https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
- https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
- https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
- https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b
- https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b
Products affected by CVE-2024-38996
-
cpe:2.3:a:ag-grid:ag-grid:-
-
cpe:2.3:a:ag-grid:ag-grid:1.0
-
cpe:2.3:a:ag-grid:ag-grid:1.1
-
cpe:2.3:a:ag-grid:ag-grid:1.10.0
-
cpe:2.3:a:ag-grid:ag-grid:1.10.1
-
cpe:2.3:a:ag-grid:ag-grid:1.11.0
-
cpe:2.3:a:ag-grid:ag-grid:1.11.1
-
cpe:2.3:a:ag-grid:ag-grid:1.12.0
-
cpe:2.3:a:ag-grid:ag-grid:1.12.1
-
cpe:2.3:a:ag-grid:ag-grid:1.12.2
-
cpe:2.3:a:ag-grid:ag-grid:1.12.3
-
cpe:2.3:a:ag-grid:ag-grid:1.12.4
-
cpe:2.3:a:ag-grid:ag-grid:1.12.5
-
cpe:2.3:a:ag-grid:ag-grid:1.12.6
-
cpe:2.3:a:ag-grid:ag-grid:1.12.7
-
cpe:2.3:a:ag-grid:ag-grid:1.12.8
-
cpe:2.3:a:ag-grid:ag-grid:1.13.0
-
cpe:2.3:a:ag-grid:ag-grid:1.14.0
-
cpe:2.3:a:ag-grid:ag-grid:1.14.1
-
cpe:2.3:a:ag-grid:ag-grid:1.15.0
-
cpe:2.3:a:ag-grid:ag-grid:1.15.1
-
cpe:2.3:a:ag-grid:ag-grid:1.16.0
-
cpe:2.3:a:ag-grid:ag-grid:1.16.1
-
cpe:2.3:a:ag-grid:ag-grid:1.2
-
cpe:2.3:a:ag-grid:ag-grid:1.3
-
cpe:2.3:a:ag-grid:ag-grid:1.4
-
cpe:2.3:a:ag-grid:ag-grid:1.4.1
-
cpe:2.3:a:ag-grid:ag-grid:1.5.0
-
cpe:2.3:a:ag-grid:ag-grid:1.6.0
-
cpe:2.3:a:ag-grid:ag-grid:1.7.0
-
cpe:2.3:a:ag-grid:ag-grid:1.8.0
-
cpe:2.3:a:ag-grid:ag-grid:1.8.1
-
cpe:2.3:a:ag-grid:ag-grid:1.9.0
-
cpe:2.3:a:ag-grid:ag-grid:1.9.1
-
cpe:2.3:a:ag-grid:ag-grid:1.9.2
-
cpe:2.3:a:ag-grid:ag-grid:10.0.0
-
cpe:2.3:a:ag-grid:ag-grid:10.0.1
-
cpe:2.3:a:ag-grid:ag-grid:10.1.0
-
cpe:2.3:a:ag-grid:ag-grid:11.0.0
-
cpe:2.3:a:ag-grid:ag-grid:12.0.0
-
cpe:2.3:a:ag-grid:ag-grid:12.0.1
-
cpe:2.3:a:ag-grid:ag-grid:12.0.2
-
cpe:2.3:a:ag-grid:ag-grid:13.0.0
-
cpe:2.3:a:ag-grid:ag-grid:13.0.1
-
cpe:2.3:a:ag-grid:ag-grid:13.0.2
-
cpe:2.3:a:ag-grid:ag-grid:13.1.0
-
cpe:2.3:a:ag-grid:ag-grid:13.1.1
-
cpe:2.3:a:ag-grid:ag-grid:13.1.2
-
cpe:2.3:a:ag-grid:ag-grid:13.2.0
-
cpe:2.3:a:ag-grid:ag-grid:13.3.0
-
cpe:2.3:a:ag-grid:ag-grid:13.3.1
-
cpe:2.3:a:ag-grid:ag-grid:14.0.0
-
cpe:2.3:a:ag-grid:ag-grid:14.1.0
-
cpe:2.3:a:ag-grid:ag-grid:14.1.1
-
cpe:2.3:a:ag-grid:ag-grid:14.2.0
-
cpe:2.3:a:ag-grid:ag-grid:15.0.0
-
cpe:2.3:a:ag-grid:ag-grid:16.0.0
-
cpe:2.3:a:ag-grid:ag-grid:16.0.1
-
cpe:2.3:a:ag-grid:ag-grid:17.0.0
-
cpe:2.3:a:ag-grid:ag-grid:17.1.0
-
cpe:2.3:a:ag-grid:ag-grid:17.1.1
-
cpe:2.3:a:ag-grid:ag-grid:18.0.0
-
cpe:2.3:a:ag-grid:ag-grid:18.0.1
-
cpe:2.3:a:ag-grid:ag-grid:18.1.0
-
cpe:2.3:a:ag-grid:ag-grid:18.1.1
-
cpe:2.3:a:ag-grid:ag-grid:18.1.2
-
cpe:2.3:a:ag-grid:ag-grid:19.0.0
-
cpe:2.3:a:ag-grid:ag-grid:19.0.1
-
cpe:2.3:a:ag-grid:ag-grid:19.1.1
-
cpe:2.3:a:ag-grid:ag-grid:19.1.2
-
cpe:2.3:a:ag-grid:ag-grid:19.1.3
-
cpe:2.3:a:ag-grid:ag-grid:19.1.4
-
cpe:2.3:a:ag-grid:ag-grid:2.0.0
-
cpe:2.3:a:ag-grid:ag-grid:2.0.1
-
cpe:2.3:a:ag-grid:ag-grid:2.1.0
-
cpe:2.3:a:ag-grid:ag-grid:2.1.1
-
cpe:2.3:a:ag-grid:ag-grid:2.1.2
-
cpe:2.3:a:ag-grid:ag-grid:2.1.3
-
cpe:2.3:a:ag-grid:ag-grid:2.2.0
-
cpe:2.3:a:ag-grid:ag-grid:2.3.0
-
cpe:2.3:a:ag-grid:ag-grid:2.3.1
-
cpe:2.3:a:ag-grid:ag-grid:2.3.2
-
cpe:2.3:a:ag-grid:ag-grid:2.3.3
-
cpe:2.3:a:ag-grid:ag-grid:2.3.4
-
cpe:2.3:a:ag-grid:ag-grid:2.3.5
-
cpe:2.3:a:ag-grid:ag-grid:2.3.6
-
cpe:2.3:a:ag-grid:ag-grid:2.3.7
-
cpe:2.3:a:ag-grid:ag-grid:20.0.0
-
cpe:2.3:a:ag-grid:ag-grid:20.1.0
-
cpe:2.3:a:ag-grid:ag-grid:20.2.0
-
cpe:2.3:a:ag-grid:ag-grid:21.0.0
-
cpe:2.3:a:ag-grid:ag-grid:21.0.1
-
cpe:2.3:a:ag-grid:ag-grid:21.1.0
-
cpe:2.3:a:ag-grid:ag-grid:21.2.0
-
cpe:2.3:a:ag-grid:ag-grid:21.2.1
-
cpe:2.3:a:ag-grid:ag-grid:21.2.2
-
cpe:2.3:a:ag-grid:ag-grid:22.0.0
-
cpe:2.3:a:ag-grid:ag-grid:22.1.0
-
cpe:2.3:a:ag-grid:ag-grid:22.1.1
-
cpe:2.3:a:ag-grid:ag-grid:23.0.0
-
cpe:2.3:a:ag-grid:ag-grid:23.0.2
-
cpe:2.3:a:ag-grid:ag-grid:23.1.0
-
cpe:2.3:a:ag-grid:ag-grid:23.1.1
-
cpe:2.3:a:ag-grid:ag-grid:23.2.0
-
cpe:2.3:a:ag-grid:ag-grid:23.2.1
-
cpe:2.3:a:ag-grid:ag-grid:24.0.0
-
cpe:2.3:a:ag-grid:ag-grid:24.1.0
-
cpe:2.3:a:ag-grid:ag-grid:25.0.0
-
cpe:2.3:a:ag-grid:ag-grid:25.0.1
-
cpe:2.3:a:ag-grid:ag-grid:25.1.0
-
cpe:2.3:a:ag-grid:ag-grid:25.2.0
-
cpe:2.3:a:ag-grid:ag-grid:25.3.0
-
cpe:2.3:a:ag-grid:ag-grid:26.0.0
-
cpe:2.3:a:ag-grid:ag-grid:26.1.0
-
cpe:2.3:a:ag-grid:ag-grid:26.2.0
-
cpe:2.3:a:ag-grid:ag-grid:27.0.0
-
cpe:2.3:a:ag-grid:ag-grid:27.0.1
-
cpe:2.3:a:ag-grid:ag-grid:27.1.0
-
cpe:2.3:a:ag-grid:ag-grid:27.2.0
-
cpe:2.3:a:ag-grid:ag-grid:27.2.1
-
cpe:2.3:a:ag-grid:ag-grid:27.3.0
-
cpe:2.3:a:ag-grid:ag-grid:28.0.0
-
cpe:2.3:a:ag-grid:ag-grid:28.1.0
-
cpe:2.3:a:ag-grid:ag-grid:28.1.1
-
cpe:2.3:a:ag-grid:ag-grid:28.2.0
-
cpe:2.3:a:ag-grid:ag-grid:28.2.1
-
cpe:2.3:a:ag-grid:ag-grid:29.0.0
-
cpe:2.3:a:ag-grid:ag-grid:29.1.0
-
cpe:2.3:a:ag-grid:ag-grid:29.2.0
-
cpe:2.3:a:ag-grid:ag-grid:29.3.0
-
cpe:2.3:a:ag-grid:ag-grid:29.3.3
-
cpe:2.3:a:ag-grid:ag-grid:29.3.4
-
cpe:2.3:a:ag-grid:ag-grid:29.3.5
-
cpe:2.3:a:ag-grid:ag-grid:3.0.0
-
cpe:2.3:a:ag-grid:ag-grid:3.1.0
-
cpe:2.3:a:ag-grid:ag-grid:3.1.1
-
cpe:2.3:a:ag-grid:ag-grid:3.1.2
-
cpe:2.3:a:ag-grid:ag-grid:3.2.0
-
cpe:2.3:a:ag-grid:ag-grid:3.2.1
-
cpe:2.3:a:ag-grid:ag-grid:3.2.2
-
cpe:2.3:a:ag-grid:ag-grid:3.3.0
-
cpe:2.3:a:ag-grid:ag-grid:3.3.0_alpha_1
-
cpe:2.3:a:ag-grid:ag-grid:3.3.1
-
cpe:2.3:a:ag-grid:ag-grid:3.3.2
-
cpe:2.3:a:ag-grid:ag-grid:3.3.3
-
cpe:2.3:a:ag-grid:ag-grid:30.0.0
-
cpe:2.3:a:ag-grid:ag-grid:30.0.1
-
cpe:2.3:a:ag-grid:ag-grid:30.0.2
-
cpe:2.3:a:ag-grid:ag-grid:30.0.3
-
cpe:2.3:a:ag-grid:ag-grid:30.0.5
-
cpe:2.3:a:ag-grid:ag-grid:30.0.6
-
cpe:2.3:a:ag-grid:ag-grid:30.1.0
-
cpe:2.3:a:ag-grid:ag-grid:30.2.0
-
cpe:2.3:a:ag-grid:ag-grid:30.2.1
-
cpe:2.3:a:ag-grid:ag-grid:31.0.0
-
cpe:2.3:a:ag-grid:ag-grid:31.0.1
-
cpe:2.3:a:ag-grid:ag-grid:31.0.2
-
cpe:2.3:a:ag-grid:ag-grid:31.0.3
-
cpe:2.3:a:ag-grid:ag-grid:31.1.0
-
cpe:2.3:a:ag-grid:ag-grid:31.1.1
-
cpe:2.3:a:ag-grid:ag-grid:31.2.0
-
cpe:2.3:a:ag-grid:ag-grid:31.2.1
-
cpe:2.3:a:ag-grid:ag-grid:31.3.0
-
cpe:2.3:a:ag-grid:ag-grid:31.3.1
-
cpe:2.3:a:ag-grid:ag-grid:31.3.2
-
cpe:2.3:a:ag-grid:ag-grid:4.0.0
-
cpe:2.3:a:ag-grid:ag-grid:4.0.1
-
cpe:2.3:a:ag-grid:ag-grid:4.0.2
-
cpe:2.3:a:ag-grid:ag-grid:4.0.3
-
cpe:2.3:a:ag-grid:ag-grid:4.0.4
-
cpe:2.3:a:ag-grid:ag-grid:4.0.5
-
cpe:2.3:a:ag-grid:ag-grid:4.0.6
-
cpe:2.3:a:ag-grid:ag-grid:4.1.0
-
cpe:2.3:a:ag-grid:ag-grid:4.1.1
-
cpe:2.3:a:ag-grid:ag-grid:4.1.2
-
cpe:2.3:a:ag-grid:ag-grid:4.1.3
-
cpe:2.3:a:ag-grid:ag-grid:4.1.4
-
cpe:2.3:a:ag-grid:ag-grid:4.1.5
-
cpe:2.3:a:ag-grid:ag-grid:4.2.0
-
cpe:2.3:a:ag-grid:ag-grid:4.2.1
-
cpe:2.3:a:ag-grid:ag-grid:4.2.2
-
cpe:2.3:a:ag-grid:ag-grid:4.2.3
-
cpe:2.3:a:ag-grid:ag-grid:4.2.4
-
cpe:2.3:a:ag-grid:ag-grid:4.2.5
-
cpe:2.3:a:ag-grid:ag-grid:4.2.6
-
cpe:2.3:a:ag-grid:ag-grid:4.2.7
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_0
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_1
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_3
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_4
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_5
-
cpe:2.3:a:ag-grid:ag-grid:5.0.0_alpha_6
-
cpe:2.3:a:ag-grid:ag-grid:5.0.1
-
cpe:2.3:a:ag-grid:ag-grid:5.0.2
-
cpe:2.3:a:ag-grid:ag-grid:5.0.3
-
cpe:2.3:a:ag-grid:ag-grid:5.0.4
-
cpe:2.3:a:ag-grid:ag-grid:5.0.5
-
cpe:2.3:a:ag-grid:ag-grid:5.0.6
-
cpe:2.3:a:ag-grid:ag-grid:5.0.7
-
cpe:2.3:a:ag-grid:ag-grid:5.1.1
-
cpe:2.3:a:ag-grid:ag-grid:5.1.2
-
cpe:2.3:a:ag-grid:ag-grid:5.2.0
-
cpe:2.3:a:ag-grid:ag-grid:5.3.0
-
cpe:2.3:a:ag-grid:ag-grid:5.3.1
-
cpe:2.3:a:ag-grid:ag-grid:5.4.0
-
cpe:2.3:a:ag-grid:ag-grid:6.0.0
-
cpe:2.3:a:ag-grid:ag-grid:6.0.1
-
cpe:2.3:a:ag-grid:ag-grid:6.1.0
-
cpe:2.3:a:ag-grid:ag-grid:6.2.0
-
cpe:2.3:a:ag-grid:ag-grid:6.2.1
-
cpe:2.3:a:ag-grid:ag-grid:6.3.0
-
cpe:2.3:a:ag-grid:ag-grid:6.4.0
-
cpe:2.3:a:ag-grid:ag-grid:6.4.1
-
cpe:2.3:a:ag-grid:ag-grid:6.4.2
-
cpe:2.3:a:ag-grid:ag-grid:7.0.0
-
cpe:2.3:a:ag-grid:ag-grid:7.0.2
-
cpe:2.3:a:ag-grid:ag-grid:7.1.0
-
cpe:2.3:a:ag-grid:ag-grid:7.2.0
-
cpe:2.3:a:ag-grid:ag-grid:7.2.1
-
cpe:2.3:a:ag-grid:ag-grid:7.2.2
-
cpe:2.3:a:ag-grid:ag-grid:8.0.0
-
cpe:2.3:a:ag-grid:ag-grid:8.0.1
-
cpe:2.3:a:ag-grid:ag-grid:8.1.0
-
cpe:2.3:a:ag-grid:ag-grid:8.1.1
-
cpe:2.3:a:ag-grid:ag-grid:8.2.0
-
cpe:2.3:a:ag-grid:ag-grid:9.0.0
-
cpe:2.3:a:ag-grid:ag-grid:9.0.2
-
cpe:2.3:a:ag-grid:ag-grid:9.0.4
-
cpe:2.3:a:ag-grid:ag-grid:9.1.0