Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.
References
| Link | Resource |
|---|---|
| https://github.com/PlutoLang/Pluto/pull/945 | Patch |
| https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7 | Vendor Advisory |
Configurations
History
05 Mar 2025, 14:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pluto-lang
Pluto-lang pluto |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | ||
| CPE | cpe:2.3:a:pluto-lang:pluto:*:*:*:*:*:*:*:* | |
| References | () https://github.com/PlutoLang/Pluto/pull/945 - Patch | |
| References | () https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7 - Vendor Advisory |
10 Sep 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-10 22:15
Updated : 2025-03-05 14:53
NVD link : CVE-2024-45597
Mitre link : CVE-2024-45597
JSON object : View
Products Affected
pluto-lang
- pluto
CWE
No CWE.