CVE-2022-25885 - OpenCVE

The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Muhammara Project	Muhammara

Configuration 1 [-]

cpe:2.3:a:muhammara_project:muhammara:*:*:*:*:*:node.js:*:*

References

Link	Resource
https://github.com/galkahana/HummusJS/issues/439	Exploit Issue Tracking Third Party Advisory
https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c	Patch Third Party Advisory
https://github.com/julianhille/MuhammaraJS/issues/188	Exploit Issue Tracking Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139	Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2022-11-01T00:00:00

Updated: 2022-11-01T00:00:00

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-25885

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-11-01T05:15:09.810

Modified: 2022-11-01T19:20:57.707

Link: CVE-2022-25885

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:muhammara_project:muhammara:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7E8836C1-85F5-4C9B-B050-A9B7E569CCBB", "versionEndExcluding": "2.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data."}, {"lang": "es", "value": "El paquete muhammara antes de 2.6.0; Todas las versiones del paquete hummus son vulnerables a la Denegaci\u00f3n de Servicio (DoS) cuando se utiliza PDFStreamForResponse() con datos no v\u00e1lidos."}], "id": "CVE-2022-25885", "lastModified": "2022-11-01T19:20:57.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-11-01T05:15:09.810", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/galkahana/HummusJS/issues/439"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/julianhille/MuhammaraJS/issues/188"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139"}, {"source": "report@snyk.io", "tags": ["Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}