CVE-2023-26364 Denial of Service of regular expression in package @adobe/css-tools

2023-11-1713:38:41

CWE-20

adobe

www.cve.org

vulnerability

adobe

css

tools

version 4.3.0

denial of service

regular expression

improper input validation

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

20.4%

JSON

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Not a product",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "4.3.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]