What is CVE-2018-11615?

CVE-2018-11615 is a high-severity vulnerability in Mosca Project, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-08-30.

How severe is CVE-2018-11615?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-11615 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Mosca Project

CVE-2018-11615

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.033 (87.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mosca_project Mosca — versions 2.8.1
Npm Mosca — versions 2.8.1

Weakness classification (CWE)

Public proof-of-concept exploits

References

zdi-disclosures@trendmicro.com (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-11615?: CVE-2018-11615 is a high-severity vulnerability in Mosca Project, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-08-30.
How severe is CVE-2018-11615?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-11615 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.