Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:48021
HistoryJul 11, 2024 - 5:58 a.m.

Out-of-bounds Read

2024-07-1105:58:40
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3
node-stringbuilder
vulnerability
out-of-bounds read
memory length calculation
information disclosure

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

30.1%

node-stringbuilder is vulnerable to Out-of-bounds Read. The vulnerability is due to incorrect memory length calculation when calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. An attacker can return previously allocated memory by providing negative indexes, leading to Information Disclosure.

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

30.1%