CVE-2022-25598

EPSS 1.9%
Veröffentlicht 30.03.2022 10:15:08
Zuletzt bearbeitet 21.11.2024 06:52:24
Quelle security@apache.org
CVE-Watchlists
Login
Unerledigt
Login

Apache DolphinScheduler user registration is vulnerable to ReDoS attacks

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Dolphinscheduler Version < 2.0.5

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.9%	0.77

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2022-25598

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-25598

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-25598

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-25598