CVE-2021-28918

Katalog CVE

CVSS 9.1 · Critical EPSS 16,7%

Kerentanan Incorrect Type Conversion or Cast pada netmask project netmask. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Rincian

Terbit di NVD

1 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

16,7% peluang dieksploitasi; lebih tinggi dari 96,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/advisories/GHSA-pch5-whg9-qr2r advisory pihak ketiga
• https://github.com/rs/node-netmask advisory pihak ketiga
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md exploit · advisory pihak ketiga
• https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210528-0010/ advisory pihak ketiga
• https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applicatio... exploit · press/media coverage · advisory pihak ketiga
• https://www.npmjs.com/package/netmask product · advisory pihak ketiga