Is CVE-2022-31147 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-31147 being exploited in the wild.

How severe is CVE-2022-31147?

Low severity, with a CVSS score of 3.1, published 5 July 2022.

Which products and versions are affected?

jquery-validation (npm) SEMVER:introduced=0,fixed=1.19.5.

Is there a fix for CVE-2022-31147?

Yes. jquery-validation (npm): upgrade to 1.19.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-31147 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-31147?

Check whether you run jquery-validation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-31147: jquery-validation ReDoS in url2 method

CVE-2022-31147 · Severity: low · CVSS 3.1 · Published 2022-07-05

jquery-validation is a popular JavaScript library used to validate HTML forms on websites. A regular expression denial of service (ReDoS) vulnerability in the library's URL validation method can cause the application to hang or become unresponsive when processing specially crafted input, potentially disrupting user access to web applications that rely on this validation.

Technologies: jquery-validation (npm). Vendors: npm.

Quick answers

Is CVE-2022-31147 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-31147 being exploited in the wild.
How severe is CVE-2022-31147?: Low severity, with a CVSS score of 3.1, published 5 July 2022.
Which products and versions are affected?: jquery-validation (npm) SEMVER:introduced=0,fixed=1.19.5.
Is there a fix for CVE-2022-31147?: Yes. jquery-validation (npm): upgrade to 1.19.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31147 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-31147?: Check whether you run jquery-validation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jquery-validation (npm): upgrade to 1.19.5 or later
```
npm install jquery-validation@1.19.5
```

Technical details

This is an exponential ReDoS (Regular Expression Denial of Service) vulnerability affecting the url2 validation method in jquery-validation. An attacker who can supply arbitrary input to this method can craft a malicious string that causes the regular expression to perform excessive backtracking, consuming CPU resources and causing the application to hang. This is an incomplete fix for a previous vulnerability (CVE-2021-43306). The vulnerability requires network access and no authentication; the attack vector is supplying malicious input through a web form. Patch version 1.19.5 addresses this issue.

Affected products

jquery-validation jquery-validation before 1.19.5

Identifiers

CVE-2022-31147
GHSA-ffmh-x56j-9rc3

Timeline

2022-07-05: disclosed: GHSA-ffmh-x56j-9rc3 published
2022-07-14: other: CVE-2022-31147 published on NVD
2022-07-05: patched: Version 1.19.5 released with fix

References

https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-ffmh-x56j-9rc3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.