CVE-2021-32723

Katalog CVE

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Uncontrolled Resource Consumption pada prismjs prism, oracle application express. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Rincian

Terbit di NVD

28 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrismJS/prism/pull/2688 patch · advisory pihak ketiga
• https://github.com/PrismJS/prism/pull/2774 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg advisory pihak ketiga