CVEvulnerability

CVE-2018-12123

4.3 MEDIUM Published 2018-11-28 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-11-28
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-115, CWE-20

Description

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

Affected configurations

• nodejs node.js (>= 6.0.0 < 6.15.0) • nodejs node.js (>= 8.0.0 < 8.14.0) • nodejs node.js (>= 10.0.0 < 10.14.0) • nodejs node.js (>= 11.0.0 < 11.3.0)

Related

Weakness · CWE (2)

  • CWE-115 Misinterpretation of Input weakness
  • CWE-20 Improper Input Validation weakness

References