Lucene search

GoogleOSV:GHSA-WJ85-W4F4-XH8H

HistoryMar 18, 2024 - 8:37 p.m.

Denial of service via regular expression

2024-03-1820:37:48

Google

osv.dev

denial of service

regular expression

vulnerable

django-wiki

malicious content

server cpu

workaround

anonymous users

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Impact

All historical installations of django-wiki are vulnerable to maliciously crafted article content, that can cause severe use of server CPU through a regular expression loop.

Patches

Workarounds

Close off access to create and edit articles by anonymous users.

References

Are there any links users can visit to find out more?

CPENameOperatorVersion
wikieq0.4.2
wikieq0.2.3
wikieq0.2b2
wikieq0.7.10
wikieq0.7.7
wikieq0.6b1
wikieq0.6b2
wikieq0.2.2
wikieq0.3rc1
wikieq0.4a2

Name	Operator	Version
wiki	eq	0.4.2
wiki	eq	0.2.3
wiki	eq	0.2b2
wiki	eq	0.7.10
wiki	eq	0.7.7
wiki	eq	0.6b1
wiki	eq	0.6b2
wiki	eq	0.2.2
wiki	eq	0.3rc1
wiki	eq	0.4a2

Rows per page:

1-10 of 651

References

github.com/django-wiki/django-wiki

github.com/django-wiki/django-wiki/commit/8e280fd6c0bd27ce847c67b2d216c6cbf920f88c

github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h

nvd.nist.gov/vuln/detail/CVE-2024-28865

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for OSV:GHSA-WJ85-W4F4-XH8H