by Kastro
Paper/Archive/CVE-2021-28918

CVE-2021-28918

mitre — Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform ind…

EPSS 15%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 96.7.967 × 2019.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refnpmjs.com/package/netmaskrefgithub.com/rs/node-netmaskrefbleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applicationsrefgithub.com/advisories/GHSA-pch5-whg9-qr2rrefgithub.com/sickcodes/security/blob/master/advisories/SICK-2021-011.mdrefsecurity.netapp.com/advisory/ntap-20210528-0010refrootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects