Lucene search

K
cve[email protected]CVE-2018-11615
HistoryAug 30, 2018 - 12:29 p.m.

CVE-2018-11615

2018-08-3012:29:00
CWE-185
CWE-20
web.nvd.nist.gov
32
cve-2018-11615
vulnerability
npm mosca
denial of service
remote attackers
authentication
exploit
crafted regular expression
zdi-can-6306
nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.965 High

EPSS

Percentile

99.6%

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Affected configurations

Vulners
NVD
Node
npmnpm_moscaRange2.8.1

CNA Affected

[
  {
    "product": "npm mosca",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.1"
      }
    ]
  }
]

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.965 High

EPSS

Percentile

99.6%