Lucene search

ZdiCVE-2018-11615

HistoryAug 30, 2018 - 12:29 p.m.

CVE-2018-11615

2018-08-3012:29:00

CWE-185

CWE-20

zdi

web.nvd.nist.gov

cve-2018-11615

vulnerability

npm mosca

denial of service

remote attackers

authentication

exploit

crafted regular expression

zdi-can-6306

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.958

Percentile

99.5%

JSON

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Affected configurations

Nvd

Vulners

Node

mosca_projectmoscaMatch2.8.1node.js

VendorProductVersionCPE
mosca_projectmosca2.8.1cpe:2.3:a:mosca_project:mosca:2.8.1:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
mosca_project	mosca	2.8.1	cpe:2.3:a:mosca_project:mosca:2.8.1:::::node.js::

CNA Affected

[
  {
    "product": "npm mosca",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.1"
      }
    ]
  }
]