CVE-2018-20801

EUVD-2019-0398 · Published Mar 18, 2019

Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 6.1.0 or higher.

Technologies

Highcharts Highcharts

Weaknesses

CWE-185CWE-1333

CVSS scores

v3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://snyk.io/vuln/npm:highcharts:20180225
https://github.com/highcharts/highcharts/commit/7c547e1e0f5e4379f94396efd559a566668c0dfa
https://security.netapp.com/advisory/ntap-20190715-0001/
https://nvd.nist.gov/vuln/detail/CVE-2018-20801
https://github.com/advisories/GHSA-xmc8-cjfr-phx3
https://github.com/highcharts/highcharts

Potentially impacted assets

See if this affects your attack surface