CVEvulnerability
CVE-2021-22931
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-170, CWE-20
Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Affected configurations
• nodejs node.js (>= 12.0.0 <= 12.12.0)
• nodejs node.js (>= 12.13.0 < 12.22.5)
• nodejs node.js (>= 14.0.0 <= 14.14.0)
• nodejs node.js (>= 14.15.0 < 14.17.5)
• nodejs node.js (>= 16.0.0 < 16.6.2)
• netapp active iq unified manager
• netapp nextgen api
• netapp oncommand insight
• netapp oncommand workflow automation
• netapp snapcenter
• oracle graalvm 20.3.3
• oracle graalvm 21.2.0
• oracle mysql cluster (<= 8.0.26)
• oracle peoplesoft enterprise peopletools 8.57
• oracle peoplesoft enterprise peopletools 8.58
• oracle peoplesoft enterprise peopletools 8.59
• siemens sinec infrastructure network services (< 1.0.1.1)
Related
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1178337 Exploit, Issue Tracking, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202401-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210923-0001/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211022-0003/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1178337 Exploit, Issue Tracking, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202401-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210923-0001/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211022-0003/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory