# sonatype-2024-011914

## Lottie Player compromise - October 2024

**Published**: Oct 31, 2024  
**CVSS Score**: Critical 9.3

### Security Details

#### Components Impacted

- **CVE ID**: sonatype-2024-011914  
- **CVE Description**: Lottie Player compromise - October 2024  
- **Published**: Oct 31, 2024  
- **CVSS Score & Severity**: 9.3 Critical  
- **CVSS Vector**: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N  
- **EPSS Score**: 0%

### Malware

- **KEV Status**: Not in KEV Catalog: No known exploits

### Affected Ecosystems

- **Source**: Sonatype

### References

- [lottiefiles.com](https://forum.lottiefiles.com/t/the-problem-of-someone-elses-popup-appearing/6470/11 "https://forum.lottiefiles.com/t/the-problem-of-someone-elses-popup-appearing/6470/11")  
- [x.com](https://x.com/LottieFiles/status/1851848602093777273 "https://x.com/LottieFiles/status/1851848602093777273")  
- [sonatype.com](/content/blog/lottie-player-compromised-in-supply-chain-attack-all-you-need-to-know "https://www.sonatype.com/blog/lottie-player-compromised-in-supply-chain-attack-all-you-need-to-know"/index.html)