Lucene search

MitreCVE-2023-51079

HistoryDec 27, 2023 - 9:15 p.m.

CVE-2023-51079

2023-12-2721:15:08

mitre

web.nvd.nist.gov

cve-2023-51079

timeout error

parsetools

subcompileexpression

mvel2 v2.5.0 final

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

19.8%

JSON

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because “the only thing that you could expect is that the parser will take a crazy amount of time to complete its task.”

Affected configurations

Nvd

Node

mvelmvelMatch2.5.0

VendorProductVersionCPE
mvelmvel2.5.0cpe:2.3:a:mvel:mvel:2.5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mvel	mvel	2.5.0	cpe:2.3:a:mvel:mvel:2.5.0:::::::*

References

github.com/mvel/mvel/issues/348

github.com/mvel/mvel/issues/348#issuecomment-1874047271

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

19.8%

JSON

Related for CVE-2023-51079