Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-hhfg-6hfc-rvxm

Опубликовано: 29 сент. 2021
Источник: github
Github: Прошло ревью
CVSS3: 5.3

Описание

Regular Expression Denial of Service in jsoneditor

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.

Пакеты

Наименование

jsoneditor

npm
Затронутые версииВерсия исправления

< 9.5.6

9.5.6

EPSS

Процентиль: 56%
0.00334
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-1333
CWE-400
CWE-697

Связанные уязвимости

CVSS3: 7.5
nvd
больше 4 лет назад

jsoneditor is vulnerable to Inefficient Regular Expression Complexity

EPSS

Процентиль: 56%
0.00334
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-1333
CWE-400
CWE-697