CVE-2022-43358 - Vulnerability Details - OpenCVE

Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Sass-lang	Libsass

Configuration 1 [-]

cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/
https://github.com/sass/libsass
https://github.com/sass/libsass/issues/3178

History

Thu, 03 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-22T00:00:00

Updated: 2024-10-03T14:34:45.835Z

Reserved: 2022-10-17T00:00:00

Link: CVE-2022-43358

Vulnrichment

Updated: 2024-08-03T13:26:02.915Z

NVD

Status : Modified

Published: 2023-08-22T19:16:29.603

Modified: 2024-11-21T07:26:19.950

Link: CVE-2022-43358

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*", "matchCriteriaId": "DD554F0E-70F8-4860-8F1A-292E60E0F9A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS)."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de pila en ast_selectors.cpp: en la funci\u00f3n Sass::ComplexSelector::has_placeholder en libsass:3.6.5-8-g210218, que puede ser explotada por atacantes para causar una denegaci\u00f3n de servicio (DoS)."}], "id": "CVE-2022-43358", "lastModified": "2024-11-21T07:26:19.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-22T19:16:29.603", "references": [{"source": "cve@mitre.org", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/sass/libsass"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/sass/libsass/issues/3178"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/sass/libsass"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/sass/libsass/issues/3178"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}