Cyber Resilience

CVE-2024-57080

High

Published: 05 February 2025

Published
05 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0019 40.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57080 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57080 is a prototype pollution vulnerability in the lib.install function of vxe-table version 4.8.10. This flaw allows attackers to supply a crafted payload that pollutes the JavaScript object prototype, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By injecting a malicious payload into the lib.install function, attackers can disrupt application functionality, causing the service to crash or become unresponsive, resulting in a DoS without affecting confidentiality or integrity.

For mitigation details, refer to the advisory at https://gist.github.com/tariqhawis/c0b5fa2d7e4edd3f000e73fb7a10ccbc. The vulnerability was published on 2025-02-05.

EU & UK References

Vulnerability details

A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Prototype pollution in public-facing JS library directly enables remote exploitation (T1190) leading to application DoS via crafted payload (T1499.004).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-8083Shared CWE-1321
CVE-2026-33993Shared CWE-1321
CVE-2026-30939Shared CWE-1321
CVE-2026-30226Shared CWE-1321
CVE-2024-57066Shared CWE-1321
CVE-2024-57067Shared CWE-1321
CVE-2024-57083Shared CWE-1321
CVE-2024-57069Shared CWE-1321
CVE-2024-12629Shared CWE-1321
CVE-2026-24888Shared CWE-1321

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely flaw remediation, directly addressing the prototype pollution vulnerability by patching vxe-table to eliminate the DoS condition.

SI-10 Information Input Validation partial match
prevent

SI-10 enforces validation of information inputs, mitigating crafted payloads targeting the lib.install function to prevent prototype pollution.

SC-5 Denial-of-service Protection good match
prevent

SC-5 provides denial-of-service protection mechanisms that limit the impact of the availability disruption caused by prototype pollution exploits.

References