GitHub Advisoryadvisory · npm

GHSA-p2c4-gxp4-j3xp Denial of service in Valine

MEDIUM Published 2021-06-21 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-34801
Ecosystem
npm
Packages
valine
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-94
Reviewed
2021-06-17

Affected packages

• npm valine: <= 1.4.14 (no fix yet)

Description

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

Related

Alias · CVE (1)

  • CVE-2021-34801 Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References