#VU64190 Incorrect Regular Expression in Nokogiri - CVE-2022-24836 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU64190

#VU64190 Incorrect Regular Expression in Nokogiri - CVE-2022-24836

Published: June 12, 2022


Vulnerability identifier: #VU64190
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-24836
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Nokogiri
Software vendor:
nokogiri.org

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to usage of an incorrect regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. A remote attacker can bypass implemented restrictions.


Remediation

Install updates from vendor's website.

External links