CVE-2018-11615: mosca_project mosca Improper Input Validation
Vulnerability summary
CVE-2018-11615 is a high (CVSS 7.8) Improper Input Validation vulnerability in mosca_project mosca. EPSS estimates a 3.35% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities.
Timeline
- 30-08-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.35%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.35% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-185Incorrect Regular ExpressionThe product specifies a regular expression in a way that causes data to be improperly matched or compared.
Affected systems
2 vendors · 3 products
