CVEvulnerability
CVE-2021-22921
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-07-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-732
Description
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
Affected configurations
• nodejs node.js (>= 12.0.0 < 12.22.2)
• nodejs node.js (>= 14.0.0 < 14.17.2)
• nodejs node.js (>= 16.0.0 < 16.4.1)
• siemens sinec infrastructure network services (< 1.0.1.1)
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1211160 Exploit, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ Patch, Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210805-0003/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1211160 Exploit, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ Patch, Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210805-0003/ Third Party Advisory