PT-2024-19365 · Unknown · Sheetjs Community Edition

Asadbek Karimov + 1 · Published 2024-04-05 · Updated 2024-08-26 · CVE-2024-22363

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SheetJS Community Edition versions prior to 0.20.2

Description The issue is related to a Regular Expression Denial of Service (ReDoS) in the SheetJS Community Edition. It is estimated that over 2,000,000 devices are potentially affected due to the high number of weekly downloads.

Recommendations For versions prior to 0.20.2, update to version 0.20.2 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-22363

Affected Products

Sheetjs Community Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-22363 · Security Note
• https://cwe.mitre.org/data/definitions/1333.html · Note
• https://cdn.sheetjs.com/advisories/CVE-2024-22363 · Note
• https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2 · Note
• https://t.me/cvenotify/75802 · Telegram Post
• https://twitter.com/liran_tal/status/1779887656152768815 · Twitter Post