CVEvulnerability

CVE-2022-43548

8.1 HIGH Published 2022-12-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Affected configurations

• nodejs node.js (>= 14.0.0 <= 14.14.0) • nodejs node.js (>= 14.15.0 < 14.21.1) • nodejs node.js (>= 16.0.0 <= 16.12.0) • nodejs node.js (>= 16.13.0 < 16.18.1) • nodejs node.js (>= 18.0.0 <= 18.11.0) • nodejs node.js 18.12.0 • nodejs node.js 19.0.0 • debian debian linux 10.0 • debian debian linux 11.0

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References