Veracode Vulnerability DatabaseVERACODE:7521Man-in-the-Middle (MitM)
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
node.js is vulnerable to a man-in-the-middle (MitM) attack. The library does not properly handle the wildcard character in the X.509 Certificate namefields. This can allow a malicious user to spoof servers and cause a MitM attack.
| CPE | Name | Operator | Version |
|---|---|---|---|
| node | le | 0.12.15 | |
| node | le | 0.10.46 | |
| node | le | 4.5.0 | |
| node | le | 6.6.0 | |
| rh-nodejs4-nodejs | eq | 4.4.2__5.el6 | |
| rh-nodejs4-http-parser | eq | 2.6.1__4.el6 | |
| node.js | le | 4.2.3 | |
| node.js | le | 0.10.36 | |
| node.js | le | 5.3.0 |
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N