Improper input validation in Ua-Parser Uap-Core
CVE-2020-5243
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.023 (82.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 82.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000
Affected products
- Ua-Parser Uap-Core — versions < 0.7.3
- Uap-Core Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p (Exploit, Third Party Advisory)
- github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1 (Patch)
Frequently asked questions
- What is CVE-2020-5243?
- CVE-2020-5243 is a medium-severity vulnerability in Ua-Parser Uap-Core, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2020-02-21.
- How severe is CVE-2020-5243?
- Medium severity. CVSS v3 base score is 5.7 out of 10.
- Is CVE-2020-5243 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.