CVE-2022-25927

Опубликовано: 26 янв. 2023

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Ссылки

https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450
Exploit
Third Party Advisory
https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ua-parser-js_project:ua-parser-js:*:*:*:*:*:node.js:*:*

Версия от 0.7.30 (включая) до 0.7.33 (исключая)

cpe:2.3:a:ua-parser-js_project:ua-parser-js:*:*:*:*:*:node.js:*:*

Версия от 0.8.1 (включая) до 1.0.33 (исключая)

EPSS

Процентиль: 81%

0.01515

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

CVE-2022-25927

CVSS3: 5.3

ubuntu

около 3 лет назад

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

CVE-2022-25927

CVSS3: 7.5

redhat

около 3 лет назад

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

CVE-2022-25927

CVSS3: 5.3

debian

около 3 лет назад

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, fr ...

GHSA-fhg7-m89q-25r3

CVSS3: 7.5

github

около 3 лет назад

ReDoS Vulnerability in ua-parser-js version

EPSS

Процентиль: 81%

0.01515

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333