CVEvulnerability

CVE-2022-32212

8.1 HIGH Published 2022-07-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284, CWE-78

Description

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Affected configurations

• nodejs node.js (>= 14.0.0 <= 14.14.0) • nodejs node.js (>= 14.15.0 < 14.20.1) • nodejs node.js (>= 16.0.0 <= 16.12.0) • nodejs node.js (>= 16.13.0 < 16.17.1) • nodejs node.js (>= 18.0.0 < 18.5.0) • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37 • siemens sinec ins (< 1.0) • siemens sinec ins 1.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References