Home > Vulnerability Database > CVE-2022-32212

Mend.io Vulnerability Database

CVE-2022-32212

Good to know:

Date: July 14, 2022

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Language: C++

Severity Score

8.1

Related Resources (17)

Url: https://security.alpinelinux.org/vuln/CVE-2022-32212

Url: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Url: https://security.netapp.com/advisory/ntap-20220915-0001/

Url: https://hackerone.com/reports/1632921

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/

Url: https://www.debian.org/security/2023/dsa-5326

Url: https://security-tracker.debian.org/tracker/CVE-2022-32212

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/

Url: https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2022-32212

Url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22884

Url: https://access.redhat.com/security/cve/CVE-2022-32212

Url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7160

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-32212

Url: https://www.mend.io/vulnerability-database/CVE-2022-32212

Severity Score

8.1

Weakness Type (CWE)

OS Command Injections

CWE-78

Top Fix

Upgrade Version

Upgrade to version v14.2.0,v16.16.0,v18.5.0

Learn More

CVSS v3.1

Base Score:	8.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2022-32212

Good to know:

Date: July 14, 2022

Language: C++

Severity Score

Related Resources (17)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?