9.8

CVE-2019-15606

Exploit

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Data is provided by the National Vulnerability Database (NVD)
Nodejs ≫ Node.Js SwEditionlts Version >= 10.0.0 < 10.19.0
Nodejs ≫ Node.Js SwEditionlts Version >= 12.0.0 < 12.15.0
Nodejs ≫ Node.Js SwEdition- Version >= 13.0.0 < 13.8.0
Oracle ≫ Graalvm Version19.3.1 SwEditionenterprise
Oracle ≫ Graalvm Version20.0.0 SwEditionenterprise
Debian ≫ Debian Linux Version10.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version8.1
Opensuse ≫ Leap Version15.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.29% 0.841
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://nodejs.org/en/blog/release/v10.19.0/
Vendor Advisory
Release Notes
https://nodejs.org/en/blog/release/v12.15.0/
Vendor Advisory
Release Notes
https://hackerone.com/reports/730779
Third Party Advisory
Exploit