CVE-2020-8201
mediumPriorität · verfolgen · 32EPSS 0.053 · 93. PerzentilDEEURUUSEPSS · bewertet 2026-10-23
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- Mitigation SYS600cisa_csaf_ot
Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–7.4
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (46)
Betroffene Produkte und Versionsbereiche.
- Hitachi Ops Center Analyzer < 10.9.1-00alle Versionencert_bundDEcpe:/a:hitachi:ops_center:analyzer__10.9.1-00
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-0486Node.js: Mehrere SchwachstellenDeutsch2020-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
- ICSA-22-111-03Hitachi Energy MicroSCADA Pro/X SYS6002022-04-21icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.
- BIT-node-2020-82012024-03-06vendor · osvUS
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
- BIT-node-min-2020-82012024-12-16vendor · osvUS
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202009-952cnnvd
- EUVD-2020-29078enisa_euvd
- BDU:2020-05657fstec_bdu
- ICSA-22-242-01fstec_bdu
- ICSA-22-242-02fstec_bdu
- GHSA-7mcp-gwc2-4c6menisa_euvd
- BIT-node-2020-8201osv
- BIT-node-min-2020-8201osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (48)
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.htmlcnnvd
- https://access.redhat.com/security/cve/cve-2020-8201cnnvd
- https://hackerone.com/reports/922597cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/cnnvd
- https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/cnnvd
- https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/#http-request-smuggling-due-to-cr-to-hyphen-conversion-high-cve-2020-8201Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-8201cnnvd
- https://packetstormsecurity.com/files/159600/Red-Hat-Security-Advisory-2020-4272-01.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan