Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | Patch Third Party Advisory |
| https://hackerone.com/reports/1211160 | Exploit Third Party Advisory |
| https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ | Patch Release Notes Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20210805-0003/ | Third Party Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | Patch Third Party Advisory |
| https://hackerone.com/reports/1211160 | Exploit Third Party Advisory |
| https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ | Patch Release Notes Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20210805-0003/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - Patch, Third Party Advisory | |
| References | () https://hackerone.com/reports/1211160 - Exploit, Third Party Advisory | |
| References | () https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/ - Patch, Release Notes, Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20210805-0003/ - Third Party Advisory |
Information
Published : 2021-07-12 11:15
Updated : 2024-11-21 05:50
NVD link : CVE-2021-22921
Mitre link : CVE-2021-22921
CVE.ORG link : CVE-2021-22921
JSON object : View
Products Affected
siemens
- sinec_infrastructure_network_services
microsoft
- windows
nodejs
- node.js
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource