Lucene search

IBM9069ABD09DF06B33D9064D9FAA82D5AED1CAFFE243E99617E1C63C1CBA14E7B6

HistoryNov 17, 2023 - 9:04 p.m.

Security Bulletin: CVE-2022-24434 An issue was discovered in the npm package dicer

2023-11-1721:04:58

www.ibm.com

cve-2022-24434

npm package dicer

denial of service

node.js

urbancode velocity

upgrade

fix

ibm

vulnerability

crash

server

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.9%

JSON

Summary

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Vulnerability Details

CVEID:CVE-2022-24434
**DESCRIPTION:**Node.js dicer module is vulnerable to a denial of service. By sending a specially-crafted form to server, a remote attacker could exploit this vulnerability to crash the node.js service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/227085 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
UCV - UrbanCode Velocity	All

Remediation/Fixes

Upgrade to 3.1.3 or later
https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ERational&product=ibm/Rational/IBM+UrbanCode+Velocity&release=All&platform=All&function=all

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmucv_-_urbancode_velocityMatch2.3.5

CPENameOperatorVersion
ibm urbancode velocityeq2.3.5

CPE	Name	Operator	Version
	ibm urbancode velocity	eq	2.3.5

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.9%

JSON

Related for 9069ABD09DF06B33D9064D9FAA82D5AED1CAFFE243E99617E1C63C1CBA14E7B6