{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2020-8172","sourceIdentifier":"support@hackerone.com","published":"2020-06-08T14:15:13.213","lastModified":"2026-06-17T03:25:59.283","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0."},{"lang":"es","value":"La reutilización de una sesión TLS puede conllevar a una omisión de la verificación del certificado del host en node versión anterior a 12.18.0 y anterior a 14.4.0"}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"n/a","product":"https://github.com/nodejs/node","versions":[{"version":"12.18.0,14.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0.0","versionEndExcluding":"12.18.0","matchCriteriaId":"9D494880-6066-460B-B384-B9188C3967FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.4.0","matchCriteriaId":"89511E55-5D62-425E-B1A3-0688FACEB53C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*","matchCriteriaId":"EABAFD73-150F-4DFE-B721-29EB4475D979"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*","matchCriteriaId":"DE57039D-E2EE-4014-A7B1-D7380D26098E"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*","versionEndExcluding":"21.1.2","matchCriteriaId":"D0DBC938-A782-433F-8BF1-CA250C332AA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*","matchCriteriaId":"909B4029-1D4F-4D60-AC6D-98C7E9FF1B15"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"B501426C-7FB5-4C0D-83E4-0279746EFBE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*","versionEndIncluding":"7.3.30","matchCriteriaId":"69D21CF6-A2D7-403B-9A22-66A892C0F57D"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*","versionStartIncluding":"7.4.0","versionEndIncluding":"7.4.29","matchCriteriaId":"156E63C9-9834-4120-A245-CF1AF6BEC040"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*","versionStartIncluding":"7.5.0","versionEndIncluding":"7.5.19","matchCriteriaId":"6111894E-B3C9-41F1-8106-6BA16980A146"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*","versionStartIncluding":"7.6.0","versionEndIncluding":"7.6.15","matchCriteriaId":"C69D247E-D8A3-4834-9240-7EACCA0F63BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndIncluding":"8.0.21","matchCriteriaId":"88B86B2E-D69E-4E1E-BCD5-8B3B9573626C"}]}]}],"references":[{"url":"https://hackerone.com/reports/811502","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","source":"support@hackerone.com","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202101-07","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200625-0002/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"support@hackerone.com","tags":["Not Applicable","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/811502","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202101-07","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200625-0002/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}}