CVE-2018-12116

Published: Nov 28, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Affected (9)

Products: Nodejs: Node.js · Suse: Suse Enterprise Storage, Suse Linux Enterprise Server, Suse Openstack Cloud

Nodejs

1 product

Node.js

Suse

3 products

Suse Enterprise Storage

Suse Linux Enterprise Server

Suse Openstack Cloud

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 6.0.0 to 6.8.1
Nodejs Node.js	From 8.0.0 to 8.8.1
Nodejs Node.js	From 6.9.0 to 6.15.0
Nodejs Node.js	From 8.9.0 to 8.14.0

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Suse Suse Enterprise Storage	Version 4
Suse Suse Linux Enterprise Server	Version 12
Suse Suse Linux Enterprise Server	Version 15
Suse Suse Openstack Cloud	Version 7
Suse Suse Openstack Cloud	Version 8