CVE-2021-4247

A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/OWASP/NodeGoat/commit/4a4d1db74c63fb4ff8d366551c3af006c25ead12	Patch Third Party Advisory
https://github.com/OWASP/NodeGoat/issues/225	Exploit Patch Third Party Advisory
https://vuldb.com/?id.216184	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:owasp:nodegoat:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-18 08:15

Updated : 2024-02-28 19:51

NVD link : CVE-2021-4247

Mitre link : CVE-2021-4247

CVE.ORG link : CVE-2021-4247

JSON object : View

Products Affected

owasp

nodegoat

CWE

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2021-4247", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-12-18T08:15:09.267", "references": [{"url": "https://github.com/OWASP/NodeGoat/commit/4a4d1db74c63fb4ff8d366551c3af006c25ead12", "tags": ["Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://github.com/OWASP/NodeGoat/issues/225", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.216184", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en OWASP NodeGoat y clasificada como problem\u00e1tica. Esta vulnerabilidad afecta a un c\u00f3digo desconocido del archivo app/routes/research.js del componente Query Parameter Handler. La manipulaci\u00f3n conduce a la denegaci\u00f3n del servicio. El ataque se puede iniciar de forma remota. El nombre del parche es 4a4d1db74c63fb4ff8d366551c3af006c25ead12. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-216184."}], "lastModified": "2022-12-22T18:37:32.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owasp:nodegoat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03504CFB-4D4E-4A9E-A7D6-564661D5661B", "versionEndExcluding": "2021-01-26"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}