{"id":"CVE-2024-57708","aliases":["EUVD-2024-54703"],"status":"disputed","description":"An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0093,"percentile":0.60889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1321","CWE-400","CWE-471","CWE-915"],"published":"2025-06-25T00:00:00Z","modified":"2026-06-17T08:13:57Z","exploits":[{"source":"exploitdb","id":"EDB-52340","title":"OneTrust SDK 6.33.0 - Denial Of Service (DoS)","type":"remote","platform":"linux","date":"2025-06-26","url":"https://www.exploit-db.com/exploits/52340"}],"references":[{"url":"https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js"},{"url":"https://github.com/brotheralameen1/Discordforschool/security/advisories/GHSA-63xr-98vc-whx5"},{"url":"https://packetstorm.news/files/id/201222/"}],"sources":{"cve":[{"id":"CVE-2024-57708","description":"An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.","status":"disputed","published":"2025-06-25T00:00:00Z","modified":"2025-07-25T20:32:40.823Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400","CWE-471","CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:34:07.482552Z"}],"euvd":[{"id":"EUVD-2024-54703","description":"An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.","status":"published","published":"2025-06-25T00:00:00Z","modified":"2025-07-25T20:32:40Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"nvd":[{"id":"CVE-2024-57708","description":"An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.","status":"disputed","published":"2025-06-25T16:15:25.59Z","modified":"2026-06-17T08:13:57.333Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-471","CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}