Lucene search

GoogleVULNRICHMENT:CVE-2024-5436

HistoryMay 31, 2024 - 8:11 a.m.

CVE-2024-5436 Type Confusion in Snapchat Lenscore

2024-05-3108:11:34

CWE-704

Google

github.com

cve-2024-5436

type confusion

snapchat lenscore

denial of service

arbitrary code execution

upgrade

CVSS4

7.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/SC:L/VI:H/SI:H/VA:H/SA:H

AI Score

7.8

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:snap:snapchat_lenscore:*:*:*:*:*:*:*:*"
    ],
    "vendor": "snap",
    "product": "snapchat_lenscore",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "12.88",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

hackerone.com/snapchat