CVE-2021-22939 Information

Description

If the Node.js https API was used incorrectly and �ndefined\ was in passed for the ejectUnauthorized\ parameter no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Reference

https://hackerone.com/reports/1278254 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ https://security.netapp.com/advisory/ntap-20210917-0003/ https://www.oracle.com/security-alerts/cpuoct2021.html https://www.oracle.com/security-alerts/cpujan2022.html https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

5.3