← Back

CVE-2019-15606

nvd nist
Published: Feb 7, 2020Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Affected (10)

Show all products
Nodejs: Node.js · Oracle: Communications Cloud Native Core Network Function Cloud Native Environment, Graalvm · Debian: Debian Linux · Redhat: Enterprise Linux, Enterprise Linux Eus · Opensuse: Leap
Nodejs
1 product
Node.js
Oracle
2 products
Communications Cloud Native Core Network Function Cloud Native Environment
Graalvm
Debian
1 product
Debian Linux
Redhat
2 products
Enterprise Linux
Enterprise Linux Eus
Opensuse
1 product
Leap
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
From 13.0.0 to 13.8.0
Node.js
From 10.0.0 to 10.19.0
Node.js
From 12.0.0 to 12.15.0
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Communications Cloud Native Core Network Function Cloud Native Environment
Version 1.4.0
Oracle
Graalvm
Version 19.3.1
Graalvm
Version 20.0.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Enterprise Linux
Version 8.0
Enterprise Linux Eus
Version 8.1
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Leap
Version 15.1

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (32)

Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
ExploitThird Party Advisory
Source: support@hackerone.com
Release NotesVendor Advisory
Source: support@hackerone.com
Release NotesVendor Advisory
Source: support@hackerone.com
Vendor Advisory
Source: support@hackerone.com
Vendor Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.