CVE-2020-26309

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ftonato/nope-validator/issues/352
https://securitylab.github.com/advisories/GHSL-2020-303-redos-nope-validator/

Configurations

No configuration.

History

28 Oct 2024, 13:58

Type	Values Removed	Values Added
Summary		(es) Validate.js proporciona una forma declarativa de validar objetos de JavaScript. Las versiones 0.11.3 y anteriores contienen una o más expresiones regulares que son vulnerables a la denegación de servicio por expresión regular (ReDoS). Al momento de la publicación, se desconoce si hay parches disponibles.

26 Oct 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-26 21:15

Updated : 2024-10-28 13:58

NVD link : CVE-2020-26309

Mitre link : CVE-2020-26309

CVE.ORG link : CVE-2020-26309

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2020-26309", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-26T21:15:14.190", "references": [{"url": "https://github.com/ftonato/nope-validator/issues/352", "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2020-303-redos-nope-validator/", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available."}, {"lang": "es", "value": "Validate.js proporciona una forma declarativa de validar objetos de JavaScript. Las versiones 0.11.3 y anteriores contienen una o m\u00e1s expresiones regulares que son vulnerables a la denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS). Al momento de la publicaci\u00f3n, se desconoce si hay parches disponibles."}], "lastModified": "2024-10-28T13:58:09.230", "sourceIdentifier": "security-advisories@github.com"}