Authorization Bypass

🗓️ 10 Feb 2020 06:22:36Reported by Veracode Vulnerability DatabaseType

Node vulnerability to authorization bypass due to trailing OWS from header value

Reporter	Title	Published	Views	Family All 148
FreeBSD	Node.js -- multiple vulnerabilities	6 Feb 202000:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affects IBM App Connect Enterprise V11	6 May 202011:05	–	ibm
IBM Security Bulletins	Security Bulletin: Version 10.16.3 of Node.js included in IBM Cloud Event Management 2.5.0 has several security vulnerabilities.	16 Apr 202005:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management	21 Jul 202213:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities	11 Jun 202016:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities.	15 Sep 202009:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics Workspace	3 Nov 202015:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Node.js	8 Jun 202122:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by vulnerabilities in Node.js(CVE-2019-15604, CVE-2019-15605, CVE-2019-15606)	11 May 202018:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2019-15606, CVE-2019-15604, CVE-2019-15605)	6 Oct 202022:54	–	ibm

Vulners

Node

nodejs nodejsMatch10.14.2-r0js

AND

AND

node nodeRange13.0.0–13.7.0js

node nodeRange11.0.0–12.14.1js

node nodeRange0.5.10–10.18.1js

nodejs node.jsRange0.10.21–5.3.0js

Source	Link
debian	www.debian.org/security/2020/dsa-4669
security	www.security.gentoo.org/glsa/202003-48
hackerone	www.hackerone.com/reports/730779
nodejs	www.nodejs.org/en/blog/release/v10.19.0/
nodejs	www.nodejs.org/en/blog/release/v12.15.0/
nodejs	www.nodejs.org/en/blog/vulnerability/february-2020-security-releases/
security	www.security.netapp.com/advisory/ntap-20200221-0004/
oracle	www.oracle.com//security-alerts/cpujul2021.html
oracle	www.oracle.com/security-alerts/cpuapr2020.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html

07 Mar 2024 23:30Current

4.7Medium risk

Vulners AI Score4.7

CVSS 27.5

CVSS 3.19.8

EPSS0.01338