by Kastro
Paper/Archive/CVE-2021-31597

CVE-2021-31597

mitre — The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when…

EPSS 2%CVSS 9.4
critical.is priorityof 100
44
CVSS 9.4 (NVD)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 81.1.811 × 2016.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

refpeople.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txtrefgithub.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1refgithub.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2refsecurity.netapp.com/advisory/ntap-20210618-0004