[email protected]CVE-2022-43548

HistoryDec 05, 2022 - 10:15 p.m.

CVE-2022-43548

2022-12-0522:15:10

CWE-78

[email protected]

web.nvd.nist.gov

385

cve

node.js

command injection

vulnerability

security

nvd

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.006

Percentile

79.6%

JSON

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://vulners.com/cve/CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Affected configurations

NVD

Node

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange14.15.0–14.21.1lts

nodejsnode.jsRange16.0.0–16.12.0-

nodejsnode.jsRange16.13.0–16.18.1lts

nodejsnode.jsRange18.0.0–18.11.0-

nodejsnode.jsMatch18.12.0lts

nodejsnode.jsMatch19.0.0-

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

VendorProductVersionCPE
nodejsnode.jscpe:/a:nodejs:node.js:::-:
nodejsnode.js18.12.0cpe:/a:nodejs:node.js:18.12.0::lts:
nodejsnode.js19.0.0cpe:/a:nodejs:node.js:19.0.0::-:

Vendor	Product	Version	CPE
nodejs	node.js		cpe:/a:nodejs:node.js:::-:
nodejs	node.js	18.12.0	cpe:/a:nodejs:node.js:18.12.0::lts:
nodejs	node.js	19.0.0	cpe:/a:nodejs:node.js:19.0.0::-:

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed in 19.0.1, 18.12.1, 16.18.1, 14.21.1",
        "status": "affected"
      }
    ]
  }
]