High severity · published Jul 14, 2022
CVE-2022-31147
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JV
Jquery Validation · Jqueryvalidation
before 1.19.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31147
Patch
https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd
Release Notes
https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5
Third Party Advisory
https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-ffmh-x56j-9rc3
More from Jquery Validation
7.5
CVE-2021-43306
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2…
7.5
CVE-2021-21252
The jQuery Validation Plugin provides drop-in validation for your existing forms