[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbsjesRh-GfHkJhAqoPE0EmRdLduseWyo75JqzyEkcWI":3,"g5a-risk:CVE-2022-23514":121},{"success":4,"data":5,"meta":118},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":35,"epssPercentile":26,"epssTimeSeries":36,"severity":38,"affectedProducts":39,"affectedProductsCount":45,"references":46,"referencesCount":70,"weaknesses":71,"weaknessesCount":45,"isActivelyExploited":80,"cisaInfo":26,"otxData":26,"relatedBlogPosts":81,"seoMetadata":82,"configurations":107,"relatedVendorCves":116,"notableEvents":117},"CVE-2022-23514","What is CVE-2022-23514?","Loofah is a general library for manipulating and transforming HTML\u002FXML documents and fragments, built on top of Nokogiri. Loofah \u003C 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.","Loofah is a general library for manipulating and transforming HTML\u002FXML documents and fragments, built on top of Nokogiri. Loofah \u003C 2.19.1 contains an ineffic...","2022-12-14T14:15:10.477","2025-11-03T22:15:55.973",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":33,"CVSSMetricV2":34,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},[],[],0.01829,[37,37,37,35,35,35,35],0.01763,"High",[40],{"vendor":41,"product":42,"version":43,"criteria":44,"vulnerable":4},"loofah_project","loofah","*","cpe:2.3:a:loofah_project:loofah:*:*:*:*:*:ruby:*:*",1,[47,52,57,61,63,65,67],{"url":48,"source":49,"tags":50},"https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah\u002Fsecurity\u002Fadvisories\u002FGHSA-486f-hjj9-9vhh","GitHub",[51],"Third Party Advisory",{"url":53,"source":54,"tags":55},"https:\u002F\u002Fhackerone.com\u002Freports\u002F1684163","Hackerone",[56,51],"Permissions Required",{"url":58,"source":59,"tags":60},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2023\u002F09\u002Fmsg00011.html","Debian",[],{"url":48,"source":49,"tags":62},[51],{"url":53,"source":54,"tags":64},[56,51],{"url":58,"source":59,"tags":66},[],{"url":68,"source":59,"tags":69},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00044.html",[],7,[72],{"id":73,"name":74,"description":75,"extendedDescription":76,"status":77,"abstraction":78,"structure":79},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.","Some regular expression engines have a feature called \"backtracking\". If the token cannot match, the engine \"backtracks\" to a position that may result in a different token that can match.\n                Backtracking becomes a weakness if all of these conditions are met:","Draft","Base","Simple",false,[],{"title":83,"metaDescription":84,"keywords":85,"canonicalUrl":86,"structuredData":87},"What is CVE-2022-23514? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-23514, a high severity cyber security vulnerability from 2022. Loofah is a general library for manipulating and transformi...","CVE-2022-23514, CVE-2022-23514 vulnerability, CVE-2022-23514 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, loofah_project security, loofah vulnerability","\u002Fwhat-is\u002Fcve-2022-23514",{"@context":88,"@type":89,"headline":83,"description":84,"datePublished":10,"dateModified":11,"author":90,"publisher":94,"about":98,"mainEntityOfPage":102,"articleSection":105,"keywords":106},"https:\u002F\u002Fschema.org","TechArticle",{"@type":91,"name":92,"url":93},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":91,"name":92,"url":93,"logo":95},{"@type":96,"url":97},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":99,"name":6,"description":100,"additionalType":101},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":103,"@id":104},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-23514","Cybersecurity","CVE-2022-23514, CVE-2022-23514 vulnerability, CVE-2022-23514 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[108],{"Operator":26,"Negate":26,"Nodes":109},[110],{"Operator":111,"Negate":80,"CPEMatch":112},"OR",[113],{"Vulnerable":4,"Criteria":44,"MatchCriteriaID":114,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":115,"VersionEndIncluding":26},"F02BB26C-B491-429A-947C-D0582D90D5B2","2.19.1",[],[],{"lastModified":11,"cacheTime":119,"version":120},1792364897542,"2.0",{"score":122,"band":123,"action":124,"scoredAt":125},48,"Medium","Plan remediation","2026-10-16T06:56:30.699256+00:00"]