cbcvebase.
CVE-2012-2330
published 2012-08-13

CVE-2012-2330: The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote…

PriorityP428medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
2.60%
83.7th percentile
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.

Affected

14 ranges
VendorProductVersion rangeFixed in
debiannodejs< nodejs 0.6.17~dfsg1-1 (bookworm)nodejs 0.6.17~dfsg1-1 (bookworm)
nodejsnodejs<= 0.6.16—
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs——
nodejsnodejs>= 0 < 0.6.17~dfsg1-10.6.17~dfsg1-1
nodejsnodejs>= 0 < 0.6.17~dfsg1-10.6.17~dfsg1-1
nodejsnodejs>= 0 < 0.6.17~dfsg1-10.6.17~dfsg1-1
nodejsnodejs>= 0 < 0.6.17~dfsg1-10.6.17~dfsg1-1

CVSS provenance

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv6.4MEDIUM
vendor_debian6.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.