GHSA-hrpp-f84w-xhfg: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-hrpp-f84w-xhfg) affects vue-moment versions prior to 4.1.0, discovered and disclosed on December 23, 2019. Vue-moment, a package providing Moment.js filters for Vue.js projects, contained an Outdated Static Dependency vulnerability. The issue was published to the GitHub Advisory Database on September 4, 2020, and was last updated on January 9, 2023. The vulnerability received a moderate severity rating with a CVSS score of 5.3 (GitHub Advisory, Snyk Report).

The vulnerability stems from vue-moment's static dependency on moment@2.19.1, rather than implementing it as an updatable dependency. The underlying issue in moment@2.19.1 contains a Regular Expression Denial of Service (ReDoS) vulnerability. The vulnerability has been assigned CWE-1104 classification. According to the CVSS v3.1 metrics, the vulnerability has a Network attack vector, Low attack complexity, requires No privileges, and needs No user interaction, with an Unchanged scope (GitHub Advisory).

The vulnerability primarily affects the availability of the system, with a Low impact rating according to CVSS metrics. When exploited, it can lead to reduced performance or interruptions in resource availability. While repeated exploitation is possible, attackers cannot completely deny service to legitimate users, resulting in either partially available resources or full availability only some of the time (Snyk Report).

The vulnerability is remotely exploitable at the protocol level, requiring no special access conditions or user interaction. The attack can be executed with repeatable success due to its low complexity nature. The vulnerability can be exploited through network-based attacks, making it accessible to remote attackers (GitHub Advisory).

The recommended mitigation is to upgrade vue-moment to version 4.1.0 or later, which addresses the static dependency issue. This update was implemented through a pull request that fixed the moment vulnerability (Vue Moment Commit).