CVE-2017-18214 — Uncontrolled Resource Consumption in Moment

CWE-400 — Uncontrolled Resource Consumption11 documents9 sources
Severity
7.5HIGHNVD
CNA6.5OSV6.5
EPSS
0.3%
top 44.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MomentMomentjs MomentTenable Nessus
Timeline
PublishedMar 4
Latest updateMar 15

Description

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶npmmoment/moment< 2.19.3
▶NVDmomentjs/moment2.19.2
▶NVDtenable/nessus8.2.3

Patches

Patch: www.tenable.com ↗Patch: www.tenable.com ↗

🔴Vulnerability Details

4
GHSA
Regular Expression Denial of Service in moment↗2018-03-05
▶
OSV
Regular Expression Denial of Service in moment↗2018-03-05
▶
CVEList
CVE-2017-18214: The moment module before 2↗2018-03-04
▶
OSV
CVE-2017-18214: The moment module before 2↗2018-03-04
▶

📋Vendor Advisories

4
Ubuntu
Moment.js vulnerabilities↗2021-03-15
▶
Microsoft
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string a different vulnerability than CVE-2016-4055.↗2018-03-13
▶
Red Hat
nodejs-moment: Regular expression denial of service↗2017-09-08
▶
Debian
CVE-2017-18214: node-moment - The moment module before 2.19.3 for Node.js is prone to a regular expression den...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-18214 nodejs-moment: Regular expression denial of service [fedora-all]↗2018-03-08
▶
Bugzilla
CVE-2017-18214 nodejs-moment: Regular expression denial of service↗2018-03-08
▶
CVE-2017-18214 — Uncontrolled Resource Consumption | cvebase