Lucene search
PRIOn knowledge basePRION:CVE-2023-23925HistoryFeb 03, 2023 - 8:15 p.m.
Design/Logic Flaw
2023-02-0320:15:00
PRIOn knowledge base
www.prio-n.com
3
switcher client
javascript sdk
version 3.1.4
regex redos
feature flag
cloud-based
strategy
unsanitized input
0.001 Low
EPSS
Percentile
37.9%
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS). This issue has been patched in version 3.1.4. As a workaround, avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.
| CPE | Name | Operator | Version |
|---|---|---|---|
| switcher_client | lt | 3.1.4 |
Related
nvd
nvd
CVE-2023-23925
2023-02-03 20:15:10
osv
osv
Switcher Client contains Regular Expression Denial of Service (ReDoS)
2023-02-02 01:33:06
CVE-2023-23925
2023-02-03 20:15:10
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2023-02-09 01:55:42
github
github
Switcher Client contains Regular Expression Denial of Service (ReDoS)
2023-02-02 01:33:06
cvelist
cvelist
cve
cve
CVE-2023-23925
2023-02-03 20:15:10