CVE-2024-5436

2024-05-3109:15:09

CWE-704

[email protected]

web.nvd.nist.gov

type confusion

snapchat lenscore

version 12.88

denial of service

arbitrary code execution

7.3 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:H/VA:H/SA:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.

Affected configurations

Vulners

Node

snapsnapchat_lenscoreRange≤12.88

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Snapchat Lenscore",
    "vendor": "Snap",
    "versions": [
      {
        "lessThan": "12.88",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]