CVE-2022-43548

Katalog CVE

CVSS 8.1 · High EPSS 14,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada nodejs node.js, debian linux. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Rincian

Terbit di NVD

5 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

14,5% peluang dieksploitasi; lebih tinggi dari 96,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ patch · advisory vendor
• https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230120-0004/ advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5326 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230427-0007/