Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Vulnerability Description
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS). This issue has been patched in version 3.1.4. As a workaround, avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability Type
CWE-1333
Vulnerability Title
switcher-client-master 安全漏洞
Vulnerability Description
switcher-client-master是Switcher API开源的一个用于使用 Switcher API 的 JavaScript SDK。 switcher-client-master 3.1.4 版本之前存在安全漏洞，该漏洞源于将输入信息用于构建正则表达式之前没有进行过滤。
CVSS Information
N/A
Vulnerability Type
N/A