CVE-2023-23925CWE-1333CWE-400

Switcher Client contains Regular Expression Denial of Service (ReDoS)

High · published February 3, 2023

CVSS v3.1
8.6
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS). This issue has been patched in version 3.1.4. As a workaround, avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-400 · Uncontrolled Resource Consumption
Published
2023-02-03T19:05Z
EPSS history
Timeline
  • 03 FEB 19:05Z
    Switcher Client contains Regular Expression Denial of Service (ReDoS)
    cvelistv5