« Volver al listado

CVE-2018-12116

Estado: ModificadaAlta (7.5)—

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Nodejs — Node.jsSuse — Suse Enterprise StorageSuse — Suse Linux Enterprise ServerSuse — Suse Openstack Cloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-12116",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve-request@iojs.org",
      "affectedData": [
        {
          "vendor": "The Node.js Project",
          "product": "Node.js",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to Node.js 6.15.0 and 8.14.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-28T17:29:00.230",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:1821",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-request@iojs.org"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve-request@iojs.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202003-48",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-request@iojs.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:1821",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202003-48",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-request@iojs.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-115"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server."
    },
    {
      "lang": "es",
      "value": "Node.js: Todas las versiones anteriores a la 6.15.0 y 8.14.0: separación de petición HTTP. Si se puede convencer a Node.js para que emplee datos Unicode no saneados proporcionados por el usuario para la opción \"path\" de una petición HTTP, los datos pueden proporcionarse para desencadenar una segunda petición HTTP no esperada y definida por el usuario para el mismo servidor."
    }
  ],
  "lastModified": "2026-06-17T01:37:11.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D107EC29-67E7-40C3-8E5A-324C9105C5E4",
              "versionEndIncluding": "6.8.1",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DEF4845-F577-4B12-AA48-39F0830B128E",
              "versionEndExcluding": "6.15.0",
              "versionStartIncluding": "6.9.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74FB695D-2C76-47AB-988E-5629D2E695E5",
              "versionEndIncluding": "8.8.1",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E79DFA7-55F8-453A-83E9-1C790902FCB8",
              "versionEndExcluding": "8.14.0",
              "versionStartIncluding": "8.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30A38AC5-A8B9-4244-8093-40C77ADFF5F2"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C649194-B8C2-49F7-A819-C635EE584ABF"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF73A3D9-6566-4CBF-AA5F-5A4B99719A1D"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_openstack_cloud:7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4B73BE9-4340-4A6B-89FE-A40FC4A10187"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9C659D0-D6DB-4313-9208-C0C49FECD290"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-request@iojs.org"
}