CVE-2018-21036 Improper Input Validation in sails-hook-sockets
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm sails-hook-sockets(npm) | < 1.5.5 | 1.5.5 |
| sailsjs sails | < 1.0.0-46 | 1.0.0-46 |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- [oss-security] 20200719 CVE-2018-21036: Sails.js before v1.0.0-46 DoS mailing-list third-party-advisory
- github.com