Lucene search

[email protected]CVE-2018-11615

HistoryAug 30, 2018 - 12:29 p.m.

CVE-2018-11615

2018-08-3012:29:00

CWE-185

CWE-20

[email protected]

web.nvd.nist.gov

cve-2018-11615

vulnerability

npm mosca

denial of service

remote attackers

authentication

exploit

crafted regular expression

zdi-can-6306

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.965 High

EPSS

Percentile

99.6%

JSON

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Affected configurations

Vulners

NVD

Node

npmnpm_moscaRange≤2.8.1

CPENameOperatorVersion
mosca_project:moscamosca project moscaeq2.8.1

CPE	Name	Operator	Version
mosca_project:mosca	mosca project mosca	eq	2.8.1

CNA Affected

[
  {
    "product": "npm mosca",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.1"
      }
    ]
  }
]