What is CVE-2020-5243?

CVE-2020-5243 is a medium-severity vulnerability in Ua-Parser Uap-Core, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2020-02-21.

How severe is CVE-2020-5243?

Medium severity. CVSS v3 base score is 5.7 out of 10.

Is CVE-2020-5243 known to be exploited?

6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Ua-Parser Uap-Core

CVE-2020-5243

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.023 (81.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.

Affected products

Ua-parser Uap-core — versions < 0.7.3
Uap-core_project Uap-core

Weakness classification (CWE)

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-5243?: CVE-2020-5243 is a medium-severity vulnerability in Ua-Parser Uap-Core, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2020-02-21.
How severe is CVE-2020-5243?: Medium severity. CVSS v3 base score is 5.7 out of 10.
Is CVE-2020-5243 known to be exploited?: 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.