Remote Code Execution (RCE)

🗓️ 12 Aug 2021 23:13:36Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 161 Views

Node.js vulnerability to Remote Code Execution, XSS, domain hijacking, and injection vulnerabilitie

Reporter	Title	Published	Views	Family All 207
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services	9 Nov 202117:59	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control	9 Dec 202107:56	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2021-22939, CVE-2021-22931, CVE-2020-7598)	17 Jan 202309:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components	19 Jan 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	31 May 202214:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus	10 Dec 202120:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by Node.js vulnerability (CVE-2021-22939)	19 Apr 202220:12	–	ibm

Vulners

Node

nodejs nodejsMatch12.19.0~dfsg-1debian

AND

debian debian_linuxMatch999

nodejs-current nodejs-currentMatch16.2.0-r0os

AND

nodejs-current nodejs-currentMatch15.14.0-r0os

AND

nodejs-current nodejs-currentMatch16.4.0-r0os

AND

nodejs-current nodejs-currentMatch14.2.0-r0os

AND

nodejs-current nodejs-currentMatch16.0.0-r0os

AND

nodejs-current nodejs-currentMatch13.12.0-r0os

AND

nodejs-current nodejs-currentMatch13.12.0-r1os

AND

nodejs-current nodejs-currentMatch15.13.0-r0os

AND

nodejs-current nodejs-currentMatch15.12.0-r0os

AND

nodejs-current nodejs-currentMatch14.0.0-r0os

AND

nodejs-current nodejs-currentMatch16.4.2-r0os

AND

nodejs-current nodejs-currentMatch14.1.0-r0os

AND

nodejs-current nodejs-currentMatch13.1.0-r0os

AND

nodejs-current nodejs-currentMatch16.6.1-r0os

AND

nodejs-current nodejs-currentMatch16.3.0-r0os

AND

nodejs-current nodejs-currentMatch16.1.0-r0os

AND

nodejs-current nodejs-currentMatch13.11.0-r0os

AND

nodejs-current nodejs-currentMatch13.13.0-r0os

AND

nodejs-current nodejs-currentMatch16.5.0-r0os

AND

nodejs-current nodejs-currentMatch14.3.0-r0os

AND

nodejs-current nodejs-currentMatch15.11.0-r0os

AND

alpinelinux alpine_linuxMatchedge

nodejs nodejsMatch12.19.0~dfsg-1debian

AND

debian debian_linuxMatch11

nodejs nodejsMatch12.15.0-r1os

AND

nodejs nodejsMatch12.22.4-r0os

AND

nodejs nodejsMatch12.21.0-r0os

AND

nodejs nodejsMatch12.22.2-r0os

AND

nodejs nodejsMatch12.22.1-r0os

AND

alpinelinux alpine_linuxMatch3.11

nodejs nodejsMatch14.17.1-r0os

AND

nodejs nodejsMatch14.16.0-r0os

AND

nodejs nodejsMatch12.17.0-r0os

AND

nodejs nodejsMatch14.17.4-r0os

AND

nodejs nodejsMatch14.16.1-r2os

AND

nodejs nodejsMatch14.17.2-r0os

AND

nodejs nodejsMatch12.16.2-r0os

AND

nodejs nodejsMatch14.17.3-r0os

AND

nodejs nodejsMatch14.17.0-r0os

AND

nodejs nodejsMatch12.15.0-r1os

AND

nodejs nodejsMatch14.16.0-r1os

AND

alpinelinux alpine_linuxMatchedge

nodejs nodejsMatch12.17.0-r0os

AND

nodejs nodejsMatch12.22.4-r0os

AND

nodejs nodejsMatch12.21.0-r0os

AND

nodejs nodejsMatch12.22.2-r0os

AND

nodejs nodejsMatch12.16.3-r0os

AND

nodejs nodejsMatch12.22.1-r0os

AND

alpinelinux alpine_linuxMatch3.12

nodejs nodejsMatch14.17.3-r0os

AND

nodejs nodejsMatch14.17.1-r0os

AND

nodejs nodejsMatch14.17.4-r0os

AND

nodejs nodejsMatch14.17.0-r0os

AND

alpinelinux alpine_linuxMatch3.14

nodejs nodejsMatch14.17.3-r0os

AND

nodejs nodejsMatch14.17.4-r0os

AND

nodejs nodejsMatch14.16.0-r0os

AND

nodejs nodejsMatch14.16.1-r1os

AND

alpinelinux alpine_linuxMatch3.13

nodejs-current nodejs-currentMatch16.6.0-r0os

AND

nodejs-current nodejs-currentMatch16.3.0-r0os

AND

alpinelinux alpine_linuxMatch3.14

nodejs nodejsMatch10.21.0~dfsg-1~deb10u1debian

AND

nodejs nodejsMatch10.24.0~dfsg-1~deb10u1debian

AND

debian debian_linuxMatch10

rh-nodejs12-nodejs rh-nodejs12-nodejsMatch12.14.1_1.el7

rh-nodejs12-nodejs rh-nodejs12-nodejsMatch12.10.0_4.el7

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2022/10/msg00006.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-22939
security	www.security.gentoo.org/glsa/202401-02
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
hackerone	www.hackerone.com/reports/1278254
nodejs	www.nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
security	www.security.netapp.com/advisory/ntap-20210917-0003/
oracle	www.oracle.com/security-alerts/cpujan2022.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html
oracle	www.oracle.com/security-alerts/cpujul2022.html

05 Jan 2024 11:25Current

4Medium risk

Vulners AI Score4

CVSS 25

CVSS 3.15.3

EPSS0.00124