CVE-2024-21524

2024-07-1005:00:05

snyk

www.cve.org

package node-stringbuilder

out-of-bounds read

incorrect memory length calculation

tobuffer

tostring

charat

information disclosure

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P

EPSS

0.001

Percentile

30.1%

JSON

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It’s possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.

CNA Affected

[
  {
    "product": "node-stringbuilder",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]