Versio.io

CVE-2021-22884

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 03-03-2021 07:15
Last modified: - 06-04-2022 06:24
Total changes: - 14

Description

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6�. When “localhost6� is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6� domain. As long as the attacker uses the “localhost6� domain, they can still apply the attack described in CVE-2018-7160.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
High
Attack complexity
Network
Attack vector
High
Availability
High
Confidentiality
High
Integrity
None
Privileges required
Unchanged
Scope
Required
User interaction
7.5
Base score
1.6
5.9
Exploitability score
Impact score
 

Verification logic

OR
OR
vendor=nodejs AND product=node.js AND software_edition=lts AND versionStartIncluding=10.0.0 AND versionEndExcluding=10.24.0
vendor=nodejs AND product=node.js AND software_edition=lts AND versionStartIncluding=12.0.0 AND versionEndExcluding=12.21.0
vendor=nodejs AND product=node.js AND software_edition=lts AND versionStartIncluding=14.0.0 AND versionEndExcluding=14.16.0
vendor=nodejs AND product=node.js AND software_edition=- AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.10.0
OR
vendor=fedoraproject AND product=fedora AND version=32
vendor=fedoraproject AND product=fedora AND version=33
vendor=fedoraproject AND product=fedora AND version=34
OR
vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=vmware_vsphere
vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=windows
vendor=netapp AND product=e-series_performance_analyzer AND version=-
vendor=netapp AND product=oncommand_insight AND version=-
vendor=netapp AND product=oncommand_workflow_automation AND version=-
vendor=netapp AND product=snapcenter AND version=-
OR
vendor=oracle AND product=graalvm AND version=19.3.5 AND software_edition=enterprise
vendor=oracle AND product=graalvm AND version=20.3.1.2 AND software_edition=enterprise
vendor=oracle AND product=graalvm AND version=21.0.0.2 AND software_edition=enterprise
vendor=oracle AND product=jd_edwards_enterpriseone_tools AND versionEndExcluding=9.2.6.0
vendor=oracle AND product=mysql_cluster AND versionEndIncluding=8.0.25
vendor=oracle AND product=nosql_database AND versionEndExcluding=20.3
vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.58
vendor=oracle AND product=peoplesoft_enterprise_peopletools AND version=8.59
OR
vendor=siemens AND product=sinec_infrastructure_network_services AND versionEndExcluding=1.0.1.1
 

Reference

 


Keywords

NVD

 

CVE-2021-22884

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.