Impact Area
Security
Severity
High
Affected Element
ServiceNow
UI Script
Salesforce
Static Resource
Rule number #
SN-JSL-017 (for ServiceNow)
SF-JSL-017 (for Salesforce)
Impact #
moment.js is vulnerable to regular expression denial of service when user input is passed unchecked into moment.duration() blocking the event loop for a period of time. A regular expression string which takes years to evaluate can be introduced, causing the browser to hang.
Remediation #
Update moment.js to the latest version.
Time to fix #
30 min
