Quick answers
- Is CVE-2021-34801 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-34801 being exploited in the wild.
- How severe is CVE-2021-34801?
- Low severity, with a CVSS score of 3.1, published 21 June 2021.
- Which products and versions are affected?
- valine (npm) SEMVER:introduced=0,last_affected=1.4.14.
- Is there a fix for CVE-2021-34801?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2021-34801 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-34801?
- Check whether you run valine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Valine 1.4.14 contains a vulnerability in User-Agent (UA) parsing that causes an application crash when processing an incomplete or malformed UA string (e.g., "Mozilla/8.0"). The root cause is improper validation of the UA field during comment processing; the vulnerability allows remote, unauthenticated attackers to submit a comment with a crafted UA value that triggers a fatal error in the comment system. When exploited, the entire comment section on an affected page becomes non-functional until the malicious comment is deleted. The attack requires no authentication and can be triggered via a standard HTTP request to submit a comment.
Affected products
- Valine Valine 1.4.14 and earlier
Identifiers
- CVE-2021-34801
- GHSA-p2c4-gxp4-j3xp
Timeline
- 2021-06-16: disclosed: Vulnerability reported on GitHub
- 2021-06-21: advisory: GHSA advisory published
- 2021-06-16: other: CVE-2021-34801 assigned