CVE-2018-11615

{"id": "CVE-2018-11615", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-08-30T12:29:00.437", "references": [{"url": "https://zerodayinitiative.com/advisories/ZDI-18-583", "tags": ["Third Party Advisory", "VDB Entry"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-185"}]}, {"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306."}, {"lang": "es", "value": "Esta vulnerabilidad permite que atacantes remotos denieguen el servicio de instalaciones vulnerables de npm mosca 2.8.1. No se requiere autenticaci\u00f3n para explotar esta vulnerabilidad. Este error en concreto existe en el procesamiento de temas. Una expresi\u00f3n regular manipulada podr\u00eda provocar el cierre inesperado del broker. Un atacante puede aprovechar esta vulnerabilidad para denegar el acceso al sistema objetivo. Anteriormente era ZDI-CAN-6306."}], "lastModified": "2019-10-09T23:33:37.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mosca_project:mosca:2.8.1:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "473CA84F-BC32-451E-ACC0-1AAFEDE359EF"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}