Lucene search

GitHub_MCVE-2021-21252

HistoryJan 13, 2021 - 7:15 p.m.

CVE-2021-21252

2021-01-1319:15:17

CWE-400

GitHub_M

web.nvd.nist.gov

214

jquery validation

npm package

redos

cve-2021-21252

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.004

Percentile

72.0%

JSON

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package “jquery-validation”. jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Affected configurations

Nvd

Vulners

Node

jqueryvalidationjquery_validationRange<1.19.3node.js

Node

netappsnapcenterMatch-

VendorProductVersionCPE
jqueryvalidationjquery_validation*cpe:2.3:a:jqueryvalidation:jquery_validation:*:*:*:*:*:node.js:*:*
netappsnapcenter-cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jqueryvalidation	jquery_validation	*	cpe:2.3:a:jqueryvalidation:jquery_validation::::::node.js::*
netapp	snapcenter	-	cpe:2.3:a:netapp:snapcenter:-:::::::*

CNA Affected

[
  {
    "vendor": "jquery-validation",
    "product": "jquery-validation",
    "versions": [
      {
        "version": "< 1.19.3",
        "status": "affected"
      }
    ]
  }
]