Lucene search

CVE-2021-37713

🗓️ 31 Aug 2021 17:08:15Reported by [email protected]Type

npm package "tar" has arbitrary file creation/overwrite and code execution vulnerability. Inadequate path sanitization on Windows systems. Upgrade to versions 4.4.18, 5.0.10, or 6.1.9

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 65
Veracode	Remote Code Execution (RCE)	1 Sep 202102:04	–	veracode
RedhatCVE	CVE-2021-37713	16 Dec 202116:50	–	redhatcve
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js tar module affects IBM Cloud Pak for Multicloud Management Managed Services	9 Nov 202118:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-37713)	22 Apr 202219:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-37713)	2 Dec 202118:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:44	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	12 Dec 202119:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 May 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	23 Nov 202115:54	–	ibm

Nvd

Node

npmjs tarRange<4.4.18node.js

npmjs tarRange5.0.0–5.0.10node.js

npmjs tarRange6.0.0–6.1.9node.js

AND

microsoft windowsMatch-

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

Source	Link
github	www.github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh
npmjs	www.npmjs.com/package/tar
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
oracle	www.oracle.com/security-alerts/cpuoct2021.html

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

31 Aug 2021 17:15Current

CVSS24.4

CVSS38.6

EPSS0.00938

CWE-22