Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-22939

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Published

2021-08-16T19:15:13.897

Last Modified

2024-11-21T05:50:58.657

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-295
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js < 12.22.5 Yes
Application nodejs node.js < 14.17.5 Yes
Application nodejs node.js < 16.6.2 Yes
Application oracle graalvm 20.3.3 Yes
Application oracle graalvm 21.2.0 Yes
Application oracle jd_edwards_enterpriseone_tools ≤ 9.2.6.1 Yes
Application oracle mysql_cluster ≤ 8.0.26 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application netapp nextgen_api - Yes
Application siemens sinec_infrastructure_network_services < 1.0.1.1 Yes
Operating System debian debian_linux 10.0 Yes
References