Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:3898
HistoryApr 17, 2017 - 2:11 a.m.

Regular Expression Denial Of Service (ReDoS)

2017-04-1702:11:56
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

uri-js is vulnerable to denial of service (DoS) attacks. These attacks are possible through the regular expression that validates if a URL is validate. There is a flaw in the regular expression which causes the program to hang and the application to consume 100% of the CPU. This is only possible if user-input is supplied to the .parse() method.

CPENameOperatorVersion
uri-jsle2.1.1

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C