8.7
CVE-2020-26311
- EPSS 0.49%
- Veröffentlicht 26.10.2024 21:15:14
- Zuletzt bearbeitet 30.10.2024 18:07:38
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginGHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Useragent Project ≫ Useragent SwPlatformnode.js
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.49% | 0.384 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| security-advisories@github.com | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
|
CWE-1333 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
https://github.com/3rd-Eden/useragent/issues/167
https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent/