Lucene search
HistoryAug 24, 2022 - 4:15 p.m.
CVE-2021-43309
exploitable
regular expression denial of service
npm package
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the “URI.expand” method
Affected configurations
Node
litejsuri-template-litenode.js
| Vendor | Product | Version | CPE |
|---|---|---|---|
| litejs | uri-template-lite | * | cpe:2.3:a:litejs:uri-template-lite:*:*:*:*:*:node.js:*:* |
Related
prion
prion
Design/Logic Flaw
2022-08-24 16:15:00
cve
cve
CVE-2021-43309
2022-08-24 16:15:09
osv
osv
uri-template-lite Regular Expression Denial of Service
2022-08-25 00:00:27
cvelist
cvelist
CVE-2021-43309 ReDoS in uri-template-lite URI.expand function
2022-08-24 15:48:36
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2022-08-25 04:18:20
github
github
uri-template-lite Regular Expression Denial of Service
2022-08-25 00:00:27
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
Related for NVD:CVE-2021-43309