CVE-2024-45815: @backstage/plugin-catalog-backend Prototype Pollution vulnerability

September 17, 2024 (updated November 18, 2024)

A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API.

References

github.com/advisories/GHSA-3x3f-jcp3-g22j
github.com/backstage/backstage
github.com/backstage/backstage/security/advisories/GHSA-3x3f-jcp3-g22j
nvd.nist.gov/vuln/detail/CVE-2024-45815

Code Behaviors & Features

Detect and mitigate CVE-2024-45815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →