Terser < 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service
Strategic Overview
- Status
- Patched in 1.2.0
- Affected Plugin
- Autopost for X (formerly Autoshare for Twitter)
- Affected Version
<= 1.1.2- CVSS
- 5.3Medium
- Weakness type
- CWE-1333 · Inefficient Regular Expression Complexity
- CVE
CVE-2022-25858
At a glance
CVE-2022-25858 is a medium-severity Inefficient Regular Expression Complexity vulnerability in the Autopost for X (formerly Autoshare for Twitter) WordPress plugin, affecting versions <= 1.1.2. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.2.0; sites on affected versions should update now. Disclosed July 2022.
Vulnerability Overview
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions. As this package is used in some WordPress plugins, this could result in the impacted plugins being vulnerable.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Remediation
Update to version 1.2.0, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: Autopost for X (formerly Autoshare for Twitter) 1.2.0 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Other vulnerabilities in Autopost for X (formerly Autoshare for Twitter)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C