Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM2BFF5C59DF1F97AEA94ED00ACAC3F4DAA66753398CDBD2DFB9F088F0E2434757
HistoryMay 15, 2023 - 5:14 p.m.

Security Bulletin: Open Source Dependency Vulnerability

2023-05-1517:14:54
www.ibm.com
18
ibm edge application manager
node.js
minimist module
vulnerability
fix
docker images

0.012 Low

EPSS

Percentile

85.5%

JSON

Summary

IBM Edge Application Manager 4.5 has resolved the vulnerability.

Vulnerability Details

CVEID:CVE-2021-44906
**DESCRIPTION:**Node.js Minimist module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in setKey() function in the index.js script. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Edge Application Manager 4.4
IBM Edge Application Manager 4.3

Remediation/Fixes

The fix/upgrade is a set of docker images, that will automatically be pulled and deployed from both dockerhub and the IBM Entitled Registry.

Workarounds and Mitigations

None

Related

prion 1
ubuntucve 1
ibm 21
debiancve 1
redos 1
veracode 1
nessus 28
githubexploit 1
cve 1
cvelist 1
osv 7
github 1
mageia 1
openvas 10
redhatcve 1
thn 1
redhat 21
rocky 3
oraclelinux 2
almalinux 3
checkpoint_advisories 1
prion
prion
Code injection
2022-03-17 16:15:00
ubuntucve
ubuntucve
CVE-2021-44906
2022-03-17 00:00:00
ibm
ibm
Security Bulletin: IBM Cognos Analytics has addressed a vulnerability (CVE-2021-44906)
2023-07-27 21:13:11
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to arbitrary code execution due to node.js minimist module ( CVE-2021-44906)
2022-07-28 14:43:54
Security Bulletin:Multiple Vulnerabilities found in Turf.js which is shipped with IBM® Intelligent Operations Center(CVE-2021-44906, CVE-2020-7598)
2023-09-05 12:47:52
debiancve
debiancve
CVE-2021-44906
2022-03-17 16:15:00
redos
redos
ROS-20240507-05
2024-05-07 00:00:00
veracode
veracode
Prototype Pollution
2022-03-18 02:42:04
nessus
nessus
RHEL 8 : minimist (Unpatched Vulnerability)
2024-05-11 00:00:00
CentOS 9 : nodejs-nodemon-2.0.20-2.el9
2024-02-29 00:00:00
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.6 Security update (Moderate) (RHSA-2022:5892)
2022-08-04 00:00:00
githubexploit
githubexploit
Exploit for Prototype Pollution in Substack Minimist
2023-10-02 15:20:35
cve
cve
CVE-2021-44906
2022-03-17 16:15:00
cvelist
cvelist
CVE-2021-44906
2022-03-17 13:05:57
osv
osv
Prototype Pollution in minimist
2022-03-18 00:01:09
Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-23 14:30:11
Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-23 00:00:00
github
github
Prototype Pollution in minimist
2022-03-18 00:01:09
mageia
mageia
Updated nodejs-minimist packages fix security vulnerability
2023-02-07 03:06:39
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0035)
2023-03-28 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:1466-1)
2022-04-29 00:00:00
openSUSE: Security Advisory for nodejs8 (SUSE-SU-2022:1694-1)
2022-05-17 00:00:00
redhatcve
redhatcve
CVE-2021-44906
2022-03-19 23:40:42
thn
thn
Solving the indirect vulnerability enigma - fixing indirect vulnerabilities without breaking your dependency tree
2022-07-01 09:45:00
redhat
redhat
(RHSA-2022:5928) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update
2022-08-08 19:39:55
(RHSA-2022:5893) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update
2022-08-03 15:36:29
(RHSA-2022:5894) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update.
2022-08-03 15:37:48
rocky
rocky
nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-23 14:30:11
nodejs:14 security, bug fix, and enhancement update
2023-01-09 14:24:14
nodejs:16 security, bug fix, and enhancement update
2022-12-15 15:42:25
oraclelinux
oraclelinux
nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-24 00:00:00
nodejs:14 security, bug fix, and enhancement update
2023-01-09 00:00:00
almalinux
almalinux
Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update
2023-01-23 00:00:00
Moderate: nodejs:14 security, bug fix, and enhancement update
2023-01-09 00:00:00
Moderate: nodejs:16 security, bug fix, and enhancement update
2022-12-15 00:00:00
checkpoint_advisories
checkpoint_advisories
JavaScript Prototype Pollution (CVE-2020-28269; CVE-2020-28272; CVE-2020-28273; CVE-2020-28442; CVE-2020-28458; CVE-2020-28472; CVE-2020-7778; CVE-2020-8158; CVE-2020-8203; CVE-2021-25912; CVE-2021-44906)
2020-06-21 00:00:00

0.012 Low

EPSS

Percentile

85.5%

JSON
Related for 2BFF5C59DF1F97AEA94ED00ACAC3F4DAA66753398CDBD2DFB9F088F0E2434757
prion1ubuntucve1ibm21debiancve1redos1veracode1nessus28githubexploit1cve1cvelist1osv7github1mageia1openvas10redhatcve1thn1redhat21rocky3oraclelinux2almalinux3checkpoint_advisories1