Vulnerability Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 12.0.0, <= 12.12.0 |
| Netapp | Active Iq Unified Manager | - |
| Netapp | Nextgen Api | - |
| Netapp | Oncommand Insight | - |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Snapcenter | - |
| Oracle | Graalvm | 20.3.3 |
| Oracle | Mysql Cluster | <= 8.0.26 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.57 |
| Siemens | Sinec Infrastructure Network Services | < 1.0.1.1 |
Related Weaknesses (CWE)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1178337ExploitIssue TrackingThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211022-0003/Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1178337ExploitIssue TrackingThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211022-0003/Third Party Advisory
FAQ
What is CVE-2021-22931?
CVE-2021-22931 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dn...
How severe is CVE-2021-22931?
CVE-2021-22931 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-22931?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js, Netapp Active Iq Unified Manager, Netapp Nextgen Api, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation.