CVE-2012-2330

2012-08-1323:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve

update method

node.js

security vulnerability

http headers

nvd

remote attackers

sensitive information

spoofing

6.3 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.007 Low

EPSS

Percentile

80.9%

JSON

The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.

CPENameOperatorVersion
nodejs:nodejsnodejsle0.6.16
nodejs:nodejsnodejseq0.7.6
nodejs:nodejsnodejseq0.7.4
nodejs:nodejsnodejseq0.7.5
nodejs:nodejsnodejseq0.7.3
nodejs:nodejsnodejseq0.7.0
nodejs:nodejsnodejseq0.7.2
nodejs:nodejsnodejseq0.7.7
nodejs:nodejsnodejseq0.7.1

CPE	Name	Operator	Version
nodejs:nodejs	nodejs	le	0.6.16
nodejs:nodejs	nodejs	eq	0.7.6
nodejs:nodejs	nodejs	eq	0.7.4
nodejs:nodejs	nodejs	eq	0.7.5
nodejs:nodejs	nodejs	eq	0.7.3
nodejs:nodejs	nodejs	eq	0.7.0
nodejs:nodejs	nodejs	eq	0.7.2
nodejs:nodejs	nodejs	eq	0.7.7
nodejs:nodejs	nodejs	eq	0.7.1