PT-2018-10699 · Npm · Mosca

Davide Quarta + 3 · Publicado 2018-06-13 · Atualizado 2019-10-09 · CVE-2018-11615

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions npm mosca version 2.8.1

Description This issue allows remote attackers to deny service on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash, allowing an attacker to deny access to the target system.

Recommendations For npm mosca version 2.8.1, update to a version that fixes the regular expression parsing issue to prevent denial-of-service attacks. As a temporary workaround, consider restricting access to the topic processing functionality until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-185

Identificadores relacionados

CVE-2018-11615

GHSA-WQG7-VRJ7-V82H

ZDI-18-583

Produtos afetados

Mosca

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-11615 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11615 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-18-583 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wqg7-vrj7-v82h · Aviso do Fabricante
• https://github.com/advisories/GHSA-wqg7-vrj7-v82h · Nota