CVE search · CVE-2021-22939
CVE-2021-22939
medium 5.3
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Details
- Status
- Modified
- Published
- Last changed
- Source
- support@hackerone.com
- Weakness
- CWE-295
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- nodejs · node.js
- oracle · graalvm
- oracle · jd_edwards_enterpriseone_tools
- oracle · mysql_cluster
- oracle · peoplesoft_enterprise_peopletools
- netapp · nextgen_api
- siemens · sinec_infrastructure_network_services
- debian · debian_linux
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1278254ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlIssue TrackingThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatchThird Party Advisory
- https://hackerone.com/reports/1278254ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlIssue TrackingThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/PatchVendor Advisory
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory