Lucene search
GitHub Advisory DatabaseGHSA-CHW2-6C7R-37P7HistoryAug 25, 2022 - 12:00 a.m.
uri-template-lite Regular Expression Denial of Service
2022-08-2500:00:27
CWE-697
CWE-1333
GitHub Advisory Database
github.com
18
redos npm package uri.expand arbitrary input
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the “URI.expand” method.
Affected configurations
Node
litejsuri-template-liteRange<22.9.0node.js
| Vendor | Product | Version | CPE |
|---|---|---|---|
| litejs | uri-template-lite | * | cpe:2.3:a:litejs:uri-template-lite:*:*:*:*:*:node.js:*:* |
Related
prion
prion
Design/Logic Flaw
2022-08-24 16:15:00
cve
cve
CVE-2021-43309
2022-08-24 16:15:09
osv
osv
uri-template-lite Regular Expression Denial of Service
2022-08-25 00:00:27
nvd
nvd
CVE-2021-43309
2022-08-24 16:15:09
cvelist
cvelist
CVE-2021-43309 ReDoS in uri-template-lite URI.expand function
2022-08-24 15:48:36
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2022-08-25 04:18:20
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
Related for GHSA-CHW2-6C7R-37P7