Vulnerability identifier: #VU47053

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7733

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
UAParser.js
Web applications / JS libraries

Vendor: Faisal Salman

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Mitigation
Install update from vendor's website.

Vulnerable software versions

UAParser.js: 0.7.0 - 0.7.21

---

External links
http://github.com/faisalman/ua-parser-js/commit/233d3bae22a795153a7e6638887ce159c63e557d
http://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666
http://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665
http://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.