// For flags

CVE-2022-21222

Regular Expression Denial of Service (ReDoS)

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

El paquete css-what versiones anteriores a 2.1.3, es vulnerable a una Denegación de Servicio por Expresión Regular (ReDoS) debido al uso de una expresión regular no segura en la variable re_attr del archivo index.js. La explotación de esta vulnerabilidad podría desencadenarse por medio de la función parse

*Credits: Snyk Research Team
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-24 CVE Reserved
  • 2022-09-30 CVE Published
  • 2024-05-21 EPSS Updated
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-1333: Inefficient Regular Expression Complexity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Css-what Project
Search vendor "Css-what Project"
 Css-what
Search vendor "Css-what Project" for product "Css-what"
 < 2.1.3
Search vendor "Css-what Project" for product "Css-what" and version " < 2.1.3"
node.js
Affected