| Titolo | Regular expression Denial of Service in mootools |
|---|
| Descrizione | The tool mootools contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). The tested version was the latest commit at the time of reporting (December 21, 2020). The attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen). CVE-2021-32821 was assigned, the current maintainer sent an update informing they’re treating this issue as a wontfix due to low impact and lack of activity on the project |
|---|
| Fonte | ⚠️ https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/ |
|---|
| Utente | misc (UID 3) |
|---|
| Sottomissione | 07/07/2021 07:08 (5 anni fa) |
|---|
| Moderazione | 07/07/2021 08:16 (1 hour later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 178008 [mootools escalationi di privilegi] |
|---|
| Punti | 20 |
|---|