Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2021-22921

UNKNOWN
Published 2021-07-12T10:22:24
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2021-22921. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

NodeJS

Node

Affected Versions:

4.0 5.0 6.0 7.0 8.0 9.0 10.0 11.0 12.0 13.0 14.0 15.0 16.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

Incorrect Permission Assignment for Critical Resource in Node

GHSA-g3w9-g82h-cmp4

Advisory Details

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-22921
WEB https://hackerone.com/reports/1211160
WEB https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
WEB https://nodejs.org/en/blog/vulnerability/july-2021-security-releases
WEB https://security.netapp.com/advisory/ntap-20210805-0003

Advisory provided by GitHub Security Advisory Database. Published: July 13, 2021, Modified: December 3, 2021

References

https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
https://hackerone.com/reports/1211160
https://security.netapp.com/advisory/ntap-20210805-0003/
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Published: 2021-07-12T10:22:24
Last Modified: 2025-04-30T22:24:32.965Z
Copied to clipboard!