2 lines
2.7 KiB
JSON
2 lines
2.7 KiB
JSON
{"affected":[{"affectedData":[{"product":"https-proxy-agent node module","vendor":"HackerOne","versions":[{"status":"affected","version":"Versions before 2.1.1"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:https-proxy-agent_project:https-proxy-agent:*:*:*:*:*:node.js:*:*","matchCriteriaId":"916937F5-B8D7-4632-8E50-EBE9D0EC19BE","versionEndExcluding":"2.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON)."},{"lang":"es","value":"https-proxy-agent en versiones anteriores a la 2.1.1 pasa la opción auth al constructor del búfer sin un saneamiento adecuado, lo que resulta en una denegación de servicio (DoS) y una fuga de memoria no inicializada en setups en donde un atacante podría enviar entradas tecleadas en el parámetro \"auth\" (p.ej., JSON)."}],"id":"CVE-2018-3739","lastModified":"2026-06-17T01:57:45.080","metrics":{"cvssMetricV2":[{"acInsufInfo":true,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":6.4,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":4.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-06-07T02:29:08.973","references":[{"source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/319532"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/319532"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"support@hackerone.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
|