Maple Labs

CVE search · CVE-2018-12116

CVE-2018-12116

high 7.5

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cve-request@iojs.org
Weakness
CWE-115, NVD-CWE-Other

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N nvd@nist.govPrimary
CVSS 2.0 medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • nodejs · node.js
  • suse · suse_enterprise_storage
  • suse · suse_linux_enterprise_server
  • suse · suse_openstack_cloud

References