7.1

CVE-2017-16026

Exploit
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Request Project ≫ Request SwPlatformnode.js Version >= 2.2.6 < 2.47.0
Request Project ≫ Request SwPlatformnode.js Version > 2.51.0 <= 2.67.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.77% 0.733
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:C/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

https://github.com/request/request/issues/1904
Third Party Advisory
Exploit
Issue Tracking
https://github.com/request/request/pull/2018
Third Party Advisory
Exploit
Issue Tracking
https://nodesecurity.io/advisories/309
Third Party Advisory
Exploit