Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-22921

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Published

2021-07-12T11:15:08.017

Last Modified

2024-11-21T05:50:55.150

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.4

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-732
Type: Primary
CWE-732

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nodejs	node.js	< 12.22.2	Yes
Application	nodejs	node.js	< 14.17.2	Yes
Application	nodejs	node.js	< 16.4.1	Yes
Operating System	microsoft	windows	-	No
Application	siemens	sinec_infrastructure_network_services	< 1.0.1.1	Yes

References

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory ([email protected])
https://hackerone.com/reports/1211160 Exploit, Third Party Advisory ([email protected])
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ Patch, Release Notes, Vendor Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20210805-0003/ Third Party Advisory ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1211160 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ Patch, Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20210805-0003/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)