CVE-2023-2968

2023-05-3018:15:09

CWE-232

JFROG

web.nvd.nist.gov

cve-2023-2968

remote attacker

denial of service

crafted

http request

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

54.1%

JSON

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.

Affected configurations

Nvd

Node

proxy_projectproxyMatch2.0.0node.js

proxy_projectproxyMatch2.1.1node.js

VendorProductVersionCPE
proxy_projectproxy2.0.0cpe:2.3:a:proxy_project:proxy:2.0.0:*:*:*:*:node.js:*:*
proxy_projectproxy2.1.1cpe:2.3:a:proxy_project:proxy:2.1.1:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
proxy_project	proxy	2.0.0	cpe:2.3:a:proxy_project:proxy:2.0.0:::::node.js::
proxy_project	proxy	2.1.1	cpe:2.3:a:proxy_project:proxy:2.1.1:::::node.js::

CNA Affected

[
  {
    "collectionURL": "https://www.npmjs.com",
    "packageName": "proxy",
    "versions": [
      {
        "lessThan": "2.1.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]