CVE-2022-25901

CVSS 5.3 MEDIUMEPSS 1.5%CWE-1333

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

18 jan 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

Produtos afetados

n/a · cookiejar n/a · org.webjars.npm:cookiejar

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73 https://github.com/bmeck/node-cookiejar/pull/39 https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5 https://lists.debian.org/debian-lts-announce/2023/09/msg00008.html https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681 https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984