GitHub Advisoryadvisory · npm

GHSA-72mh-269x-7mh5 Improper Certificate Validation in xmlhttprequest-ssl

CRITICAL Published 2021-05-24 Modified 2021-05-20 Official page ↗
Aliases
CVE-2021-31597
Ecosystem
npm
Packages
xmlhttprequest-ssl
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-295
Reviewed
2021-05-20

Affected packages

• npm xmlhttprequest-ssl: < 1.6.1 → fixed in 1.6.1

Description

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Related

Alias · CVE (1)

  • CVE-2021-31597 The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References