ipsambeatae
Version:
Shared dependencies of Compass, the MongoDB extension for VSCode and MongoSH
158 lines (157 loc) • 5.99 kB
JSON
{
"resultsPerPage": 1,
"startIndex": 0,
"totalResults": 1,
"format": "NVD_CVE",
"version": "2.0",
"timestamp": "2023-05-20T20:17:04.630",
"vulnerabilities": [
{
"cve": {
"id": "CVE-2022-32214",
"sourceIdentifier": "support@hackerone.com",
"published": "2022-07-14T15:15:08.337",
"lastModified": "2023-02-23T16:32:25.683",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS)."
},
{
"lang": "es",
"value": "El parser llhttp anteriores a la versión v14.20.1, anteriores a la versión v16.17.1 y anteriores a la versión v18.9.1 del módulo http en Node.js no utiliza estrictamente la secuencia CRLF para delimitar las peticiones HTTP. Esto puede llevar a un contrabando de peticiones HTTP (HRS)"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [{ "lang": "en", "value": "CWE-444" }]
},
{
"source": "support@hackerone.com",
"type": "Secondary",
"description": [{ "lang": "en", "value": "CWE-444" }]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2.1.5",
"matchCriteriaId": "C2150173-C986-4D63-AA7F-9618AA856F2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.0.7",
"matchCriteriaId": "FBB4A716-D0D0-4319-BAF0-7F012973330A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "14.0.0",
"versionEndIncluding": "14.14.0",
"matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"versionStartIncluding": "14.15.0",
"versionEndExcluding": "14.20.0",
"matchCriteriaId": "3EB02718-B2A5-4822-B611-D62BB9EF44B0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "16.0.0",
"versionEndIncluding": "16.12.0",
"matchCriteriaId": "1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"versionStartIncluding": "16.13.0",
"versionEndExcluding": "16.16.0",
"matchCriteriaId": "D9D9B02E-C965-408B-999E-1F3DA09B62AA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "18.0.0",
"versionEndExcluding": "18.5.0",
"matchCriteriaId": "D224E154-915A-4E2C-A0D7-D28D1C1472F7"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://hackerone.com/reports/1524692",
"source": "support@hackerone.com",
"tags": ["Exploit", "Issue Tracking", "Third Party Advisory"]
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/",
"source": "support@hackerone.com",
"tags": ["Patch", "Vendor Advisory"]
},
{
"url": "https://www.debian.org/security/2023/dsa-5326",
"source": "support@hackerone.com",
"tags": ["Third Party Advisory"]
}
]
}
}
]
}