6.3

CVE-2024-39001: ag-grid ag_charts Prototype Pollution

CVSS: 6.3v3.1MediumAnalyzed
AliasesGHSA-328p-362g-r48jCGA-24gq-qcvw-p7f8CGA-28jg-69h8-fpq5
Published 01-07-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-39001 is a medium (CVSS 6.3) Prototype Pollution vulnerability in ag-grid ag_charts. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.83%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-3MPQ-GFFQ-CXPWCGA-G756-5PJ8-3463CGA-W4P5-9585-6F4G

Timeline

  1. 01-07-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.83%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

0.00 pp

From 0.83% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.83%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • githubUnverified

    C1590660750744F25E86Ba1Bf240844B

    Maturity: poc

  • githubUnverified

    F8037D492Dab0D77Bca719E05D31C08B

    Maturity: poc

  • githubUnverified

    18E8C27F3A6376E7Cf082Cfe1Ca766Fa

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard30 products
  • opensearch-dashboards-2< 2.16.0-r0
  • opensearch-dashboards-2-alerting-dashboards-plugin< 2.16.0-r0
  • opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.16.0-r0
  • opensearch-dashboards-2-config< 2.16.0-r0
  • opensearch-dashboards-2-dashboards-maps< 2.16.0-r0
Ag-grid2 products
Npm2 products
  • ag-grid-community≥ 32.0.0, < 32.0.1 | < 31.3.4
  • ag-grid-enterprise≥ 32.0.0, < 32.0.1 | < 31.3.4
@ag-grid-enterprise1 product
  • charts≥ 32.0.0, < 32.0.1 | < 31.3.4

4 vendors · 35 products

References

11 links
Show all 11 references