Vulnerabilities > CVE-2021-27292 - Unspecified vulnerability in Ua-Parser-Js Project Ua-Parser-Js

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

ua-parser-js-project

NVD

Published: 2021-03-17

Updated: 2021-03-23

Summary

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Vulnerable Configurations

Part	Description	Count
Application	Ua-Parser-Js_Project UA Parser JS Project UA Parser JS 0.7.14 UA Parser JS Project UA Parser JS 0.7.15 UA Parser JS Project UA Parser JS 0.7.16 UA Parser JS Project UA Parser JS 0.7.17 UA Parser JS Project UA Parser JS 0.7.18 UA Parser JS Project UA Parser JS 0.7.19 UA Parser JS Project UA Parser JS 0.7.20 UA Parser JS Project UA Parser JS 0.7.21 UA Parser JS Project UA Parser JS 0.7.22 UA Parser JS Project UA Parser JS 0.7.23	10

Summary

Vulnerable Configurations

References