Detections
Analytics
Moment.js < 2.11.2 Regular Expression Denial of Service
medium Web App Scanning Plugin ID 112445
Language:
Synopsis
Moment.js < 2.11.2 Regular Expression Denial of ServiceDescription
According to its self-reported version number, Moment.js is prior to 2.11.2. Therefore, it may be affected by a regular expression denial of service vulnerability when arbitrary user input is passed into moment.duration().Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Moment.js version 2.11.2 or later.See Also
Plugin Details
Severity: Medium
ID: 112445
Type: remote
Family: Component Vulnerability
Published: 11/5/2018
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2016-4055
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score Source: CVE-2016-4055
Vulnerability Information
CPE: cpe:2.3:a:moment_project:moment:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/23/2017
Vulnerability Publication Date: 10/25/2015
Reference Information
CVE: CVE-2016-4055
BID: 95849
OWASP: 2010-A1, 2013-A1, 2013-A9, 2017-A1, 2017-A9, 2021-A3, 2021-A6
WASC: Denial of Service, Improper Input Handling
CAPEC: 10, 101, 104, 108, 109, 110, 120, 13, 135, 136, 14, 147, 153, 182, 197, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 45, 46, 47, 473, 492, 52, 53, 588, 63, 64, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-002400, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.12.6.1, 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SC-5, sp800_53-SI-10
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3