CVE-2020-8201
mediumpriority · track · 32EPSS 0.053 · 93 %ileDEEURUUSEPSS · scored 2026-10-23
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- Mitigation SYS600cisa_csaf_ot
Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–7.4
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (46)
Products and version ranges known to be affected.
- Hitachi Ops Center Analyzer < 10.9.1-00all versionscert_bundDEcpe:/a:hitachi:ops_center:analyzer__10.9.1-00
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-0486Node.js: Mehrere SchwachstellenDeutsch2020-09-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
- ICSA-22-111-03Hitachi Energy MicroSCADA Pro/X SYS6002022-04-21icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.
- BIT-node-2020-82012024-03-06vendor · osvUS
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
- BIT-node-min-2020-82012024-12-16vendor · osvUS
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
also known as (8)
Other names and identifiers for this entity.
- CNNVD-202009-952cnnvd
- EUVD-2020-29078enisa_euvd
- BDU:2020-05657fstec_bdu
- ICSA-22-242-01fstec_bdu
- ICSA-22-242-02fstec_bdu
- GHSA-7mcp-gwc2-4c6menisa_euvd
- BIT-node-2020-8201osv
- BIT-node-min-2020-8201osv
sources
Which sources assert this record, and when.
references (48)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.htmlcnnvd
- https://access.redhat.com/security/cve/cve-2020-8201cnnvd
- https://hackerone.com/reports/922597cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/cnnvd
- https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/cnnvd
- https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/#http-request-smuggling-due-to-cr-to-hyphen-conversion-high-cve-2020-8201Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-8201cnnvd
- https://packetstormsecurity.com/files/159600/Red-Hat-Security-Advisory-2020-4272-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan