CVE-2022-25844

Description

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: .repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

1.924

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM MQ 9.0	Windows
Multiple Vulnerabilities are affected in IBM MQ 9.1	Windows
Multiple Vulnerabilities are affected in IBM MQ 9.2	Windows
Inefficient Regular Expression Complexity Vulnerability (CVE-2022-25844)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234