Lucene search

GoogleOSV:GHSA-X2JX-W3WM-9P3P

HistoryDec 05, 2022 - 6:30 a.m.

nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit

2022-12-0506:30:22

Google

osv.dev

nadeshiko 3

nako3edit

remote attacker

code injection

vulnerability

decodeuricomponent.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

78.9%

JSON

Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.

References

github.com/kujirahand/nadesiko3

github.com/kujirahand/nadesiko3/issues/1325

github.com/kujirahand/nadesiko3/issues/1347

github.com/kujirahand/nadesiko3/releases/tag/3.3.75

jvn.jp/en/jp/JVN56968681/index.html

nvd.nist.gov/vuln/detail/CVE-2022-41777

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.006

Percentile

78.9%

JSON

Related for OSV:GHSA-X2JX-W3WM-9P3P