« Volver al listado

CVE-2020-8201

Estado: ModificadaAlta (7.4)—

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Fedoraproject — FedoraNodejs — Node.jsOpensuse — Leap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8201",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "NodeJS",
          "product": "Node",
          "versions": [
            {
              "status": "affected",
              "version": "4.0",
              "lessThan": "4.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.0",
              "lessThan": "5.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0",
              "lessThan": "6.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.0",
              "lessThan": "7.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.0",
              "lessThan": "8.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.0",
              "lessThan": "9.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.0",
              "lessThan": "11.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.0",
              "lessThan": "12.18.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.0",
              "lessThan": "13.*",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "14.0",
              "lessThan": "14.11.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2020-09-18T21:15:12.903",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/922597",
      "tags": [
        "Permissions Required"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202101-07",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20201009-0004/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hackerone.com/reports/922597",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202101-07",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20201009-0004/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names."
    },
    {
      "lang": "es",
      "value": "Node.js versiones anteriores a 12.18.4 y versiones anteriores a 14.11, pueden ser explotado para llevar a cabo ataques de desincronización HTTP y entregar cargas útiles maliciosas a usuarios desprevenidos.&#xa0;Las cargas útiles pueden ser diseñadas por un atacante para secuestrar sesiones de usuario, envenenar cookies, llevar a cabo secuestro del click y una multitud de otros ataques dependiendo de la arquitectura del sistema subyacente.&#xa0;El ataque fue posible debido a un error en el procesamiento de los símbolos carrier-return en los nombres de encabezado HTTP"
    }
  ],
  "lastModified": "2026-06-17T03:26:02.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CB8E8E0-24CC-417B-96D7-AF53B2296661",
              "versionEndExcluding": "12.18.4",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA70BBF0-BD24-4786-A705-48F26FF4B34B",
              "versionEndExcluding": "14.11.0",
              "versionStartIncluding": "14.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}