CVE-2018-12120

CWE-419 CWE-829 CWE-284 — Improper Access Control10 documents8 sources

Severity

8.1HIGH

EPSS

0.4%

top 37.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Nodejs Node.js THE Node.js Project Node.js

Timeline

PublishedNov 28

Latest updateMay 13

Description

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages4 packages

▶NVDnodejs/node.js6.0.0 — 6.15.0

▶Debiannodejs< 8.9.3~dfsg-5+3

▶CVEListV5the_node.js_project/node.jsAll versions prior to Node.js 6.15.0

▶CVEListV5big-ip14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4

Patches

Patch: nodejs.org ↗Patch: nodejs.org ↗

🔴Vulnerability Details

GHSA

GHSA-8fqw-43x4-4q75: Node↗2022-05-13

▶

CVEList

CVE-2018-12120: Node↗2018-11-28

▶

OSV

CVE-2018-12120: Node↗2018-11-28

▶

📋Vendor Advisories

CVE-2019-6644: Similar to the issue identified in CVE-2018-12120, on versions 14↗2019-09-04

▶

Red Hat

nodejs: Debugger port 5858 listens on any interface by default↗2018-11-27

▶

Debian

CVE-2018-12120: nodejs - Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any...↗2018

▶

💬Community

Bugzilla

CVE-2018-12120 nodejs: Debugger port 5858 listens on any interface by default [epel-all]↗2018-12-19

▶

Bugzilla

CVE-2018-12120 nodejs: Debugger port 5858 listens on any interface by default [fedora-all]↗2018-12-19

▶

Bugzilla

CVE-2018-12120 nodejs: Debugger port 5858 listens on any interface by default↗2018-12-19

▶