CVE-2021-22931

Опубликовано: 16 авг. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://hackerone.com/reports/1178337
Exploit
Issue Tracking
Third Party Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
Patch
Vendor Advisory
https://security.gentoo.org/glsa/202401-02
https://security.netapp.com/advisory/ntap-20210923-0001/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0003/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://hackerone.com/reports/1178337
Exploit
Issue Tracking
Third Party Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
Patch
Vendor Advisory
https://security.gentoo.org/glsa/202401-02
https://security.netapp.com/advisory/ntap-20210923-0001/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211022-0003/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 12.0.0 (включая) до 12.12.0 (включая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 12.13.0 (включая) до 12.22.5 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 14.0.0 (включая) до 14.14.0 (включая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 14.15.0 (включая) до 14.17.5 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 16.0.0 (включая) до 16.6.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:nextgen_api:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Версия до 8.0.26 (включая)

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Версия до 1.0.1.1 (исключая)

EPSS

Процентиль: 72%

0.00738

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-170

CWE-20

Связанные уязвимости

CVE-2021-22931

CVSS3: 9.8

ubuntu

почти 4 года назад

CVE-2021-22931

CVSS3: 5

redhat

почти 4 года назад

CVE-2021-22931

CVSS3: 9.8

msrc

почти 4 года назад

Описание отсутствует

CVE-2021-22931

CVSS3: 9.8

debian

почти 4 года назад

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Co ...

GHSA-7r9p-c88x-w357

CVSS3: 9.8

github

около 3 лет назад

EPSS

Процентиль: 72%

0.00738

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-170

CWE-20