semver-regex <= 3.1.3 and 4.0.0-4.0.3 - Regular Expression Denial of Service (ReDoS)
2022-05-13 00:00
AnonymousStrategic Overview
StatusPatched in 1.0.5
Affected PluginInsert Special Characters
Affected Version
<= 1.0.4CVSS7.5High
CVE
CVE-2021-43307Vulnerability Overview
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method. Some WordPress plugins and themes use this dependency though that doesn’t necessarily mean the plugin itself is vulnerable to exploitation.
Technical Analysis
REMEDIATION: Update to version 1.0.5, or a newer patched version --- IDENTIFIER: CWE-1333 (Inefficient Regular Expression Complexity) The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C