Lucene search

HackeroneCVE-2017-16116

HistoryJun 07, 2018 - 2:29 a.m.

CVE-2017-16116

2018-06-0702:29:02

CWE-400

hackerone

web.nvd.nist.gov

string module

regular expression

denial of service

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

44.0%

JSON

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Affected configurations

Nvd

Node

string_projectstringRange≤0.2.1node.js

string_projectstringRange0.2.2–3.3.3node.js

VendorProductVersionCPE
string_projectstring*cpe:2.3:a:string_project:string:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
string_project	string	*	cpe:2.3:a:string_project:string::::::node.js::*

CNA Affected

[
  {
    "product": "string node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]