PT-2018-11027 · Node.Js+2 · Node.Js+2

Published 2018-05-25 · Updated 2022-09-06 · CVE-2018-12120

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.15.0

Description The issue allows remote computers to attach to the debug port and evaluate arbitrary JavaScript when the debugger is enabled with node --debug or node debug, as it listens on all interfaces by default. The default interface is now localhost. It has always been possible to start the debugger on a specific interface. The debugger was removed in Node.js 8 and replaced with the inspector.

Recommendations For Node.js versions prior to 6.15.0, consider starting the debugger on a specific interface, such as node --debug=localhost, to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-419

CWE-829

Related Identifiers

ALT-PU-2018-1807

CVE-2018-12120

MGASA-2019-0277

OPENSUSE-SU-2019_0088-1

OPENSUSE-SU-2019_0234-1

SUSE-SU-2019:0117-1

SUSE-SU-2019:0395-1

Affected Products

Alt Linux

Node.Js

Suse

References · 68

• https://osv.dev/vulnerability/MGASA-2019-0277 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01636 · Security Note
• https://bdu.fstec.ru/vul/2019-02939 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12120 · Security Note
• https://nodejs.org/en/blog/vulnerability/november-2018-security-releases · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12120 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-12120 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1807 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0395-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0117-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12120 · Security Note