CVE-2021-22931

Katalog CVE

CVSS 9.8 · Critical EPSS 22,0%

Kerentanan Improper Null Termination pada nodejs node.js, netapp active iq unified manager +8 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Rincian

Terbit di NVD

16 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-170: Improper Null Termination
CWE-20: Improper Input Validation

EPSS (30 hari)

22,0% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ patch · advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://hackerone.com/reports/1178337 exploit · issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210923-0001/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211022-0003/ advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga
• https://security.gentoo.org/glsa/202401-02