Lucene search

Veracode Vulnerability DatabaseVERACODE:47657

HistoryJun 20, 2024 - 5:58 a.m.

Denial Of Service (DoS)

2024-06-2005:58:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

socket.io

vulnerability

denial of service

node.js

uncaught exception

malicious packet

server crash

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

socket.io is vulnerable to Denial Of Service (DoS). The vulnerability is due to a specially crafted Socket.IO packet triggering an uncaught exception, which kills the Node.js process, allowing an attacker to crash the server by sending a malicious packet.

CPENameOperatorVersion
socket.iole2.5.0
socket.iole4.6.1
socket.iole2.5.0
socket.iole4.6.1

Name	Operator	Version
socket.io	le	2.5.0
socket.io	le	4.6.1
socket.io	le	2.5.0
socket.io	le	4.6.1

References

github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115

github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c

github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for VERACODE:47657