요약
- CVE-2015-8854은(는) marked (marked project), marked에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 4.4%, 전체 취약점의 91.4%보다 높음.
- 조치: 0.3.4 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| marked | < 0.3.4
| 0.3.4
|
| marked npm | < 0.3.4
| 0.3.4
|
Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
NVD description
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free