CVE-2024-39249 (Medium) detected in async-3.2.5.tgz

[ashishkrz]

CVE-2024-39249 - Medium Severity Vulnerability

Vulnerable Library - async-3.2.5.tgz

Library home page: https://registry.npmjs.org/async/-/async-3.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @console/console-platform-nconf-1.0.7.tgz (Root Library)
  • nconf-0.12.1.tgz
    • ❌ async-3.2.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.

Publish Date: 2024-07-01

URL: CVE-2024-39249

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

[aearly]

Dupe of #1975