A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
References
| Link | Resource |
|---|---|
| https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html | Mailing List Third Party Advisory |
| https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ | Patch Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230120-0004/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230427-0007/ | |
| https://www.debian.org/security/2023/dsa-5326 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
27 Apr 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Mar 2023, 16:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Debian
Debian debian Linux |
|
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html - Mailing List, Third Party Advisory | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20230120-0004/ - Third Party Advisory | |
| References | (DEBIAN) https://www.debian.org/security/2023/dsa-5326 - Third Party Advisory |
26 Feb 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Jan 2023, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jan 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Dec 2022, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| References | (MISC) https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ - Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:* cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
|
| First Time |
Nodejs
Nodejs node.js |
|
| CWE | CWE-78 |
05 Dec 2022, 23:40
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-05 22:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-43548
Mitre link : CVE-2022-43548
CVE.ORG link : CVE-2022-43548
JSON object : View
Products Affected
nodejs
- node.js
debian
- debian_linux
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')