{"id":"CVE-2024-38998","aliases":["EUVD-2024-37693","GHSA-m3r7-wx5j-gx67","SUSE-SU-2024:3771-1","UBUNTU-CVE-2024-38998"],"status":"rejected","title":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config....","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1321"],"published":"2024-07-01T00:00:00Z","modified":"2026-02-04T02:25:55Z","exploits":[{"source":"pocgithub","id":"c4bsec/PP_CVE-2024-38998","title":"c4bsec/PP_CVE-2024-38998","date":"2025-01-08","url":"https://github.com/c4bsec/PP_CVE-2024-38998"}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38998"},{"url":"https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a","tags":["report"]},{"url":"https://github.com/advisories/GHSA-m3r7-wx5j-gx67"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38998","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-38998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38998","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-38998","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-07-01T00:00:00Z","modified":"2025-01-28T19:44:53.337Z","updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-37693","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2025-01-28T19:44:53Z","updated_at":"2026-11-03T00:04:10.781258Z"}],"ghsa":[{"id":"GHSA-m3r7-wx5j-gx67","title":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config....","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T15:32:18Z","modified":"2024-07-03T18:47:43Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:57:38.140316Z"}],"nvd":[{"id":"CVE-2024-38998","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-07-01T13:15:05.223Z","modified":"2025-01-28T20:15:31.103Z","updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"UBUNTU-CVE-2024-38998","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2024-07-01T13:15:00Z","modified":"2025-07-08T14:32:32.112573Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"CVE-2024-38998","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2024-07-01T13:15:05Z","modified":"2025-01-29T12:48:31.387811Z","updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}