CVE search · CVE-2021-22921
CVE-2021-22921
high 7.8
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
Details
- Status
- Modified
- Published
- Last changed
- Source
- support@hackerone.com
- Weakness
- CWE-732
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1211160ExploitThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/PatchRelease NotesVendor Advisory
- https://security.netapp.com/advisory/ntap-20210805-0003/Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1211160ExploitThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/PatchRelease NotesVendor Advisory
- https://security.netapp.com/advisory/ntap-20210805-0003/Third Party Advisory