PT-2017-8452 · Moment.Js+2 · Moment+2

Publicado 2017-01-23 · Atualizado 2026-06-04 · CVE-2016-4055

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions moment versions prior to 2.11.2

Description The duration function in the moment package allows remote attackers to cause a denial of service (CPU consumption) via a long string, also known as a "regular expression Denial of Service (ReDoS)". This issue is triggered when arbitrary user input is passed into moment.duration().

Recommendations For moment versions prior to 2.11.2, please update to version 2.11.2 or later.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2016-4055

GHSA-87VV-R9J6-G5QV

GHSA-HXF5-MG84-PJ4M

USN-4786-1

Produtos afetados

Jira

Ubuntu

Moment

Referências · 31

• 🔥 https://nodesecurity.io/advisories/55 · Exploit
• https://github.com/moment/moment · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4055 · Nota de Segurança
• https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E · Nota
• https://github.com/advisories/GHSA-hxf5-mg84-pj4m · Nota
• https://t.me/cvenotify/31174 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2016/04/20/11 · Nota
• https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E · Nota
• https://npmjs.com/advisories/55 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4055 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-18214 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2016-4055 · Aviso do Fabricante
• https://tenable.com/security/tns-2019-02 · Correção
• https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4055 · Aviso do Fabricante