CVE-2018-12123: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is…

medium4.3CVSS 3.1

AVNACLPRNUIRSUCNILAN

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	nodejs	< nodejs 10.15.0~dfsg-6 (bookworm)	nodejs 10.15.0~dfsg-6 (bookworm)
msrc	cm1_nodejs_14.17.2-1_on_cbl_mariner_1.0	—	—
nodejs	node.js	>= 10.0.0 < 10.14.0	10.14.0
nodejs	node.js	>= 11.0.0 < 11.3.0	11.3.0
nodejs	node.js	>= 6.0.0 < 6.15.0	6.15.0
nodejs	node.js	>= 8.0.0 < 8.14.0	8.14.0
nodejs	nodejs	>= 0 < 10.15.0~dfsg-6	10.15.0~dfsg-6
nodejs	nodejs	>= 0 < 10.15.0~dfsg-6	10.15.0~dfsg-6
nodejs	nodejs	>= 0 < 10.15.0~dfsg-6	10.15.0~dfsg-6
nodejs	nodejs	>= 0 < 10.15.0~dfsg-6	10.15.0~dfsg-6
nodejs	nodejs	>= 0 < 0.10.25~dfsg2-2ubuntu1.2+esm1	0.10.25~dfsg2-2ubuntu1.2+esm1
nodejs	nodejs	>= 0 < 4.2.6~dfsg-1ubuntu4.2+esm1	4.2.6~dfsg-1ubuntu4.2+esm1
nodejs	nodejs	>= 0 < 8.10.0~dfsg-2ubuntu0.4+esm1	8.10.0~dfsg-2ubuntu0.4+esm1
the_node.js_project	node.js	—	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

osv5.9MEDIUM