9.8

CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nodejs ≫ Node.Js SwEditionlts Version >= 10.0.0 < 10.19.0
Nodejs ≫ Node.Js SwEditionlts Version >= 12.0.0 < 12.15.0
Nodejs ≫ Node.Js SwEdition- Version >= 13.0.0 < 13.8.0
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version30
Opensuse ≫ Leap Version15.1
Redhat ≫ Software Collections Version1.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version7.7
Redhat ≫ Enterprise Linux Eus Version8.1
Redhat ≫ Enterprise Linux Eus Version8.2
Redhat ≫ Enterprise Linux Eus Version8.4
Redhat ≫ Enterprise Linux Eus Version8.6
Oracle ≫ Graalvm Version19.3.1 SwEditionenterprise
Oracle ≫ Graalvm Version20.0.0 SwEditionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 32.25% 0.967
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

https://nodejs.org/en/blog/release/v10.19.0/
Vendor Advisory
Release Notes
https://nodejs.org/en/blog/release/v12.15.0/
Vendor Advisory
Release Notes
https://hackerone.com/reports/735748
Third Party Advisory
Permissions Required