Home > Vulnerability Database > CVE-2022-32212

Mend.io Vulnerability Database

CVE-2022-32212

Date: July 13, 2022

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Language: C++

Severity Score

8.1

Related Resources (17)

Url: https://security.alpinelinux.org/vuln/CVE-2022-32212

Url: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Url: https://security.netapp.com/advisory/ntap-20220915-0001/

Url: https://hackerone.com/reports/1632921

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/

Url: https://www.debian.org/security/2023/dsa-5326

Url: https://security-tracker.debian.org/tracker/CVE-2022-32212

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/

Url: https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html

Url: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2022-32212

Url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22884

Url: https://access.redhat.com/security/cve/CVE-2022-32212

Url: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7160

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-32212

Url: https://www.mend.io/vulnerability-database/CVE-2022-32212

Severity Score

8.1

Weakness Type (CWE)

Improper Access Control

CWE-284

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

CVSS v3.1

Base Score:	8.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2022-32212

Date: July 13, 2022

Language: C++

Severity Score

Related Resources (17)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?