« Volver al listado

CVE-2024-34394

Estado: AplazadaAlta (8.1)—

libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Libxmljs2 — Libxmljs2AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34394",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34394",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-02T19:57:23.256207Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "reefs@jfrog.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "reefs@jfrog.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "0.37.0"
            }
          ],
          "packageName": "libxmljs2",
          "collectionURL": "https://www.npmjs.com",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:marudor:libxmljs2:*:*:*:*:*:*:*:*"
          ],
          "vendor": "marudor",
          "product": "libxmljs2",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-02T19:15:06.630",
  "references": [
    {
      "url": "https://github.com/marudor/libxmljs2/issues/205",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/",
      "source": "reefs@jfrog.com"
    },
    {
      "url": "https://github.com/marudor/libxmljs2/issues/205",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "reefs@jfrog.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution."
    },
    {
      "lang": "es",
      "value": "libxmljs2 es afectada por una vulnerabilidad de confusión de tipos cuando analiza un XML especialmente manipulado mientras se invoca la función namespaces() (que invoca XmlNode::get_local_namespaces()) en un nieto de un nodo que hace referencia a una entidad. Esta vulnerabilidad puede provocar denegación de servicio y ejecución remota de código."
    }
  ],
  "lastModified": "2026-10-03T10:16:38.343",
  "sourceIdentifier": "reefs@jfrog.com"
}