CVE-2021-22931 (High) detected in node

[tmarkley]

CVE-2021-22931 - High Severity Vulnerability

⚠️ Vulnerable Libraries: node@10.24.1

Dependency Hierarchy

• node@10.24.1 (Root Library)

Found in base branch: main

🕵️ Vulnerability Details

Description

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Publish Date

2021-08-16

URL

CVE-2021-22931

🎯 CVSS 3 Score Details (9.8)

Scores

Base: 9.8
Exploitability: 3.9
Impact: 5.9
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability Metrics

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)
Network (AV:N)	Low (AC:L)	None (PR:N)	None (UI:N)	Unchanged (S:U)

Impact Metrics

Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
High (C:H)	High (I:H)	High (A:H)

🔧 Suggested Fix

How to fix?

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

Origin

https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-1540538

[mend-for-github-com]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.