title: Denial of Service of regular expression in package @adobe/css-tools
description: @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
problem types: Improper Input Validation (CWE-20)
affected:
{
defaultStatus: affected
product: Not a product
vendor: Adobe
versions:
lessThanOrEqual: 4.3.1, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
availabilityRequirement: NOT_DEFINED
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.3
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: LOW
modifiedConfidentialityImpact: NONE
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5.3
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL