CVE-2017-16113: Input Validation

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is rated as network-accessible with low attack complexity. It requires no privileges and no user interaction, but the attacker must be able to provide input that the application passes to parsejson.

Q: What is the expected security impact?

The reported impact is high on availability, consistent with denial of service. No confidentiality or integrity impact is identified.

Q: Does the available information identify affected versions or a safe default configuration?

No affected or fixed version is provided, and the available information does not state whether any particular default configuration is affected.

Published Jun 7, 2018

Updated

The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.

Affected Software

1 affected component

Parsejson Project Parsejson Node.js<=0.0.3

Event History

Jun 7, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is rated as network-accessible with low attack complexity. It requires no privileges and no user interaction, but the attacker must be able to provide input that the application passes to parsejson.

What is the expected security impact?

The reported impact is high on availability, consistent with denial of service. No confidentiality or integrity impact is identified.

Does the available information identify affected versions or a safe default configuration?

No affected or fixed version is provided, and the available information does not state whether any particular default configuration is affected.

CVE-2017-16113: Input Validation

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact?

Does the available information identify affected versions or a safe default configuration?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact?

Does the available information identify affected versions or a safe default configuration?