CVE-2020-36830

A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of the component Backtracking. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.5.1 is able to address this issue. The identifier of the patch is e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9. It is recommended to upgrade the affected component.
Configurations

Configuration 1 (hide)

cpe:2.3:a:nescalante:urlregex:*:*:*:*:*:*:*:*

History

05 Sep 2024, 21:47

Type Values Removed Values Added
CPE cpe:2.3:a:nescalante:urlregex:*:*:*:*:*:*:*:*
First Time Nescalante urlregex
Nescalante
CVSS v2 : 4.0
v3 : 4.3
v2 : 4.0
v3 : 7.5
References () https://github.com/nescalante/urlregex/commit/e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9 - () https://github.com/nescalante/urlregex/commit/e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9 - Patch
References () https://github.com/nescalante/urlregex/pull/8 - () https://github.com/nescalante/urlregex/pull/8 - Exploit
References () https://github.com/nescalante/urlregex/releases/tag/v0.5.1 - () https://github.com/nescalante/urlregex/releases/tag/v0.5.1 - Release Notes
References () https://vuldb.com/?ctiid.276269 - () https://vuldb.com/?ctiid.276269 - Permissions Required
References () https://vuldb.com/?id.276269 - () https://vuldb.com/?id.276269 - Third Party Advisory

03 Sep 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en nescalante urlregex hasta la versión 0.5.0 y se ha clasificado como problemática. Este problema afecta a un procesamiento desconocido del archivo index.js del componente Backtracking. La manipulación provoca una complejidad ineficiente de las expresiones regulares. El ataque puede iniciarse de forma remota. El exploit se ha hecho público y puede utilizarse. La actualización a la versión 0.5.1 puede solucionar este problema. El identificador del parche es e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9. Se recomienda actualizar el componente afectado.

02 Sep 2024, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-02 18:15

Updated : 2024-09-05 21:47


NVD link : CVE-2020-36830

Mitre link : CVE-2020-36830

CVE.ORG link : CVE-2020-36830


JSON object : View

Products Affected

nescalante

  • urlregex
CWE
CWE-1333

Inefficient Regular Expression Complexity