CVE-2022-25881

Aliases:GHSA-rc47-6667-2j5j
Advisory lineage Upstream: 0 Downstream: 19
Modified
Published: 31 Jan 2023, 05:00
Last modified:27 Mar 2025, 17:16

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.18% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

31 Jan 2023, 05:00
Published
Vulnerability first disclosed
27 Mar 2025, 17:16
Last Modified
Vulnerability information updated

Description

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.18%• Percentile: 39%

Techniques & Countermeasures

  • CWE-1333•Inefficient Regular Expression Complexity

    The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Affected Systems

  • http-cache-semantics_project•http-cache-semantics

    < 4.1.1

  • org.webjars.npm•http-cache-semantics

    < 4.1.1

  • Npm•http-cache-semantics

    < 4.1.1

  • wordpress•simple-local-avatars

    ≤ 2.7.3

References (9)