CVE Vulnerability

CVE-2022-25901

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5 Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984 Exploit Third Party Advisory
https://github.com/bmeck/node-cookiejar/pull/39 Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681 Exploit Third Party Advisory
https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73 Broken Link
Configurations

Configuration 1

cpe:2.3:a:cookiejar_project:cookiejar:*:*:*:*:*:node.js:*:*
Information

Published : 2023-01-18 05:15

Updated : 2023-01-25 06:21

NVD link : CVE-2022-25901

Mitre link : CVE-2022-25901

Products Affected
No products.
CWE
CWE-1333

Inefficient Regular Expression Complexity