CVE-2012-2330

2012-08-1323:55:01

CWE-20

redhat

web.nvd.nist.gov

cve

update method

node.js

security vulnerability

http headers

nvd

remote attackers

sensitive information

spoofing

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.007

Percentile

80.9%

JSON

The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.

Affected configurations

Nvd

Node

nodejsnodejsRange≤0.6.16

nodejsnodejsMatch0.7.0

nodejsnodejsMatch0.7.1

nodejsnodejsMatch0.7.2

nodejsnodejsMatch0.7.3

nodejsnodejsMatch0.7.4

nodejsnodejsMatch0.7.5

nodejsnodejsMatch0.7.6

nodejsnodejsMatch0.7.7

VendorProductVersionCPE
nodejsnodejs*cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*
nodejsnodejs0.7.0cpe:2.3:a:nodejs:nodejs:0.7.0:*:*:*:*:*:*:*
nodejsnodejs0.7.1cpe:2.3:a:nodejs:nodejs:0.7.1:*:*:*:*:*:*:*
nodejsnodejs0.7.2cpe:2.3:a:nodejs:nodejs:0.7.2:*:*:*:*:*:*:*
nodejsnodejs0.7.3cpe:2.3:a:nodejs:nodejs:0.7.3:*:*:*:*:*:*:*
nodejsnodejs0.7.4cpe:2.3:a:nodejs:nodejs:0.7.4:*:*:*:*:*:*:*
nodejsnodejs0.7.5cpe:2.3:a:nodejs:nodejs:0.7.5:*:*:*:*:*:*:*
nodejsnodejs0.7.6cpe:2.3:a:nodejs:nodejs:0.7.6:*:*:*:*:*:*:*
nodejsnodejs0.7.7cpe:2.3:a:nodejs:nodejs:0.7.7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodejs	nodejs	*	cpe:2.3:a:nodejs:nodejs::::::::
nodejs	nodejs	0.7.0	cpe:2.3:a:nodejs:nodejs:0.7.0:::::::*
nodejs	nodejs	0.7.1	cpe:2.3:a:nodejs:nodejs:0.7.1:::::::*
nodejs	nodejs	0.7.2	cpe:2.3:a:nodejs:nodejs:0.7.2:::::::*
nodejs	nodejs	0.7.3	cpe:2.3:a:nodejs:nodejs:0.7.3:::::::*
nodejs	nodejs	0.7.4	cpe:2.3:a:nodejs:nodejs:0.7.4:::::::*
nodejs	nodejs	0.7.5	cpe:2.3:a:nodejs:nodejs:0.7.5:::::::*
nodejs	nodejs	0.7.6	cpe:2.3:a:nodejs:nodejs:0.7.6:::::::*
nodejs	nodejs	0.7.7	cpe:2.3:a:nodejs:nodejs:0.7.7:::::::*