PT-2020-9127 · Ecstatic · Ecstatic

Published 2020-01-02 · Updated 2020-12-15 · CVE-2019-10775

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 4.1.2 ecstatic versions prior to 3.3.2 ecstatic versions prior to 2.2.2

Description The issue allows for a denial of service, potentially causing an application to crash. It is also related to an Open Redirect vulnerability, where the package fails to validate redirects. This failure enables attackers to craft requests that result in an HTTP 301 redirect to any other domain.

Recommendations If using ecstatic 4.x, upgrade to 4.1.2 or later. If using ecstatic 3.x, upgrade to 3.3.2 or later. If using ecstatic 2.x, upgrade to 2.2.2 or later.

Fix

Open Redirect

Resource Exhaustion

Weakness Enumeration

CWE-601

CWE-400

Related Identifiers

CVE-2019-10775

GHSA-9Q64-MPXX-87FG

GHSA-JC84-3G44-WF2Q

SNYK-JS-ECSTATIC-540354

Affected Products

Ecstatic

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10775 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10775 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jc84-3g44-wf2q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9q64-mpxx-87fg · Vendor Advisory
• https://snyk.io/vuln/SNYK-JS-ECSTATIC-540354 · Note
• https://npmjs.com/advisories/830 · Note