CVE-2022-1929 Vulnerability Details

  /     /     /  

CVE-2022-1929 Metadata Quick Info

CVE Published: 01/06/2022 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: JFROG | Vendor: devcert | Product: devcert
Status : PUBLISHED

---

CVE-2022-1929 Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

Metrics

CVSS Version: 3.1 | Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* NONE
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-1333
CWE Name: CWE-1333 Inefficient Regular Expression Complexity
Source: devcert

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).