| Vulnerability Name: | CVE-2022-24434 (CCN-227085) | ||||||||||||
| Assigned: | 2022-05-19 | ||||||||||||
| Published: | 2022-05-19 | ||||||||||||
| Updated: | 2022-06-07 | ||||||||||||
| Summary: | This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes. | ||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) 6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:R)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:R)
| ||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
| ||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-24434 Source: XF Type: UNKNOWN nodejs-cve202224434-dos(227085) Source: CONFIRM Type: Patch, Third Party Advisory N/A Source: CONFIRM Type: Exploit, Issue Tracking, Patch, Third Party Advisory N/A Source: CCN Type: dicer GIT Repository Removed a bug which could cause a crash in HeaderParser, and as consequence could potentially crash a web server based on it #22 Source: CONFIRM Type: Patch, Third Party Advisory N/A Source: CCN Type: SNYK-JS-DICER-2311764 Denial of Service (DoS) Source: CONFIRM Type: Exploit, Third Party Advisory N/A Source: CONFIRM Type: Exploit, Third Party Advisory N/A Source: CCN Type: IBM Security Bulletin 6600749 (Cloud Pak for Automation) Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2022 Source: CCN Type: IBM Security Bulletin 6611175 (Cloud Pak for Integration) Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-24434 Source: CCN Type: IBM Security Bulletin 6620901 (Watson Discovery) IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js Source: CCN Type: IBM Security Bulletin 6621267 (Cloud Pak for Watson AIOps) A security vulnerability in Node.js dicer affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Managed Services Source: CCN Type: IBM Security Bulletin 6845810 (Watson Assistant for Cloud Pak for Data) IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js dicer module denial of service(CVE-2022-24434) Source: CCN Type: IBM Security Bulletin 6848225 (Netcool Operations Insight) Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities. Source: CCN Type: IBM Security Bulletin 6980821 (QRadar Use Case Manager) IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities Source: CCN Type: IBM Security Bulletin 6986505 (Cognos Analytics) IBM Cognos Analytics has addressed multiple vulnerabilities Source: CCN Type: IBM Security Bulletin 6991559 (Edge Application Manager) Open Source Dependency Vulnerability Source: CCN Type: IBM Security Bulletin 7005455 (Spectrum Discover) IBM Spectrum Discover is vulnerable to multiple vulnerabilities | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||