CVEvulnerability
CVE-2021-31597
9.4 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-04-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.4 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-295
Description
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Affected configurations
• xmlhttprequest-ssl project xmlhttprequest-ssl (< 1.6.1)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2 Patch, Third Party Advisory
- https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 Patch, Release Notes, Third Party Advisory
- https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210618-0004/ Third Party Advisory
- https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2 Patch, Third Party Advisory
- https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 Patch, Release Notes, Third Party Advisory
- https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210618-0004/ Third Party Advisory