CVE-2022-23496

EUVD-2022-7593 · Published Dec 8, 2022

Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List

Impact

Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected.

Patches

Upgrade to 7.9.0

Workarounds

Catch and discard any exceptions from Yauaa.

Technologies

Yet_Another_Useragent_Analyzer_Project Yet Another Useragent Analyzer

Weaknesses

CWE-755

CVSS scores

v3.18.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9e
https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7h
https://nvd.nist.gov/vuln/detail/CVE-2022-23496
https://github.com/nielsbasjes/yauaa

Potentially impacted assets

See if this affects your attack surface