melnaron mel-spintax lib/spintax.js text denial of service

Una vulnerabilità di livello problematico è stata rilevata in melnaron mel-spintax. Riguarda una funzione sconosciuta del file lib/spintax.js. Attraverso la manipolazione del parametro text di un input sconosciuto per mezzo di una vulerabilità di classe denial of service. L'advisory è scaricabile da github.com. CVE-2018-25077 è identificato come punto debole. L'attacco può avvenire nelle rete locale. I dettagli tecnici sono conosciuti. È stato dichiarato come non definito. Il bugfix è scaricabile da github.com. Il miglior modo suggerito per attenuare il problema è applicare le correzioni al componente problematico. Una possibile soluzione è stata pubblicata già prima e non dopo la pubblicazione della vulnerabilità.

Campo16/01/2023 23:5209/02/2023 08:5409/02/2023 08:57
vendormelnaronmelnaronmelnaron
namemel-spintaxmel-spintaxmel-spintax
filelib/spintax.jslib/spintax.jslib/spintax.js
argumenttexttexttext
cwe1333 (denial of service)1333 (denial of service)1333 (denial of service)
risk111
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier37767617846e27b87b63004e30216e8f919637d337767617846e27b87b63004e30216e8f919637d337767617846e27b87b63004e30216e8f919637d3
urlhttps://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3https://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3https://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3
namePatchPatchPatch
patch_name37767617846e27b87b63004e30216e8f919637d337767617846e27b87b63004e30216e8f919637d337767617846e27b87b63004e30216e8f919637d3
patch_urlhttps://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3https://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3https://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3
advisoryquoteFix possible ReDoS attackFix possible ReDoS attackFix possible ReDoS attack
cveCVE-2018-25077CVE-2018-25077CVE-2018-25077
responsibleVulDBVulDBVulDB
date1673823600 (16/01/2023)1673823600 (16/01/2023)1673823600 (16/01/2023)
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_avAAA
cvss2_vuldb_acMMM
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_avAAA
cvss3_vuldb_acLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_eXXX
cvss2_vuldb_basescore2.32.32.3
cvss2_vuldb_tempscore2.02.02.0
cvss3_vuldb_basescore3.53.53.5
cvss3_vuldb_tempscore3.43.43.4
cvss3_meta_basescore3.53.54.8
cvss3_meta_tempscore3.43.44.8
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1673823600 (16/01/2023)1673823600 (16/01/2023)
cve_nvd_summaryA vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss2_nvd_avA
cvss2_nvd_acM
cvss2_nvd_auS
cvss2_nvd_ciN
cvss2_nvd_iiN
cvss2_nvd_aiP
cvss3_cna_avA
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore2.3
cvss3_nvd_basescore7.5
cvss3_cna_basescore3.5

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!