CVE-2021-29418

vendorUSosv

view advisory published 2021-03-30Licence: per source

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-28918US	critical9.1	15.0% (97th)	—	2021-04-01
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on ma…

references

External citations — patches, advisories, analysis.

https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4FIX
https://security.netapp.com/advisory/ntap-20210604-0001/ADVISORY
https://vuln.ryotak.me/advisories/6ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan