Vulnerabilities > CVE-2022-23514 - Unspecified vulnerability in Loofah Project Loofah

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

loofah-project

NVD

Published: 2022-12-14

Updated: 2023-09-13

Summary

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.

Vulnerable Configurations

Part	Description	Count
Application	Loofah_Project Loofah Project Loofah 0.2.0 Loofah Project Loofah 0.2.1 Loofah Project Loofah 0.2.2 Loofah Project Loofah 0.3.0 Loofah Project Loofah 0.3.1 Loofah Project Loofah 0.4.0 Loofah Project Loofah 0.4.1 Loofah Project Loofah 0.4.2 Loofah Project Loofah 0.4.3 Loofah Project Loofah 0.4.4 Loofah Project Loofah 0.4.5 Loofah Project Loofah 0.4.6 Loofah Project Loofah 0.4.7 Loofah Project Loofah 1.0.0 Loofah Project Loofah 1.1.0 Loofah Project Loofah 1.2.0 Loofah Project Loofah 1.2.1 Loofah Project Loofah 2.0.0 Loofah Project Loofah 2.0.1 Loofah Project Loofah 2.0.2 Loofah Project Loofah 2.0.3 Loofah Project Loofah 2.1.0 Loofah Project Loofah 2.1.1 Loofah Project Loofah 2.2.0 Loofah Project Loofah 2.2.1 Loofah Project Loofah 2.2.2 Loofah Project Loofah 2.2.3 Loofah Project Loofah 2.3.0 Loofah Project Loofah 2.3.1	32

Summary

Vulnerable Configurations

References