Back to Database
Status published
High
CVE-2018-11615
This vulnerability allows remote attackers to deny service on vulnerable...
Vulnerability Description
This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-11615
Credits & Attribution
No credits recorded in the NVD database.
More from npm
View All →CVE-2023-31999
All versions of @fastify/oauth2 used a statically generated state parameter...
Unknown
0
CVE-2022-29244
npm packing does not respect root-level ignore files in workspaces
Unknown
0
CVE-2021-39135
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High
8.2
CVE-2021-39134
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High
8.2
CVE-2021-37713
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
High
8.2
Affected Vendor
Affected Software
npm mosca
Vulnerable Versions:
2.8.1
Timeline
Official Publish:
August 30th, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H