Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:40945
HistoryJun 19, 2023 - 5:47 p.m.

Regular Expression Denial Of Service (ReDoS)

2023-06-1917:47:12
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
10
microsoft
enterprise library
regular expression denial of service
admcontentbuilder
denial of service
cpu cycles

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.007

Percentile

80.1%

Microsoft patterns & practices Enterprise Library is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability is due a regex string with inefficient complexity located in Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs, which allows an attacker to input a string composed of many \ (backslash) characters followed by a " (double quote), resulting in Denial of Service by consuming excessive CPU cycles.

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.007

Percentile

80.1%

Related for VERACODE:40945