Vulnerability · Published May 20, 2022 · Assigned by snyk
CVE-2022-24434Denial of Service (DoS)
High 7.5
In plain English
A high-severity security flaw in dicer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.webjars.npm:dicer | no fix listed | GHSA-wm7h-9275-46v2 |
| npm | dicer | no fix listed | GHSA-wm7h-9275-46v2 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-DICER-2311764 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865 x_refsource_MISC
- https://github.com/mscdex/dicer/pull/22 x_refsource_MISC
- https://github.com/mscdex/busboy/issues/250 x_refsource_MISC
- https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac x_refsource_MISC