Description
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected products
- nodejs / node.js6.0.0 – 6.8.1
- nodejs / node.js6.9.0 – 6.15.0
- SUSE / suse_enterprise_storage4 – 4
- SUSE / SUSE Linux Enterprise Server15 – 15
- SUSE / SUSE Linux Enterprise Server12 – 12
- SUSE / suse_openstack_cloud8 – 8
- SUSE / suse_openstack_cloud7 – 7
- The Node.js Project / Node.jsAll versions prior to Node.js 6.15.0 and 8.14.0 – All versions prior to Node.js 6.15.0 and 8.14.0
Updated 23m ago · 8 sources