Published: 28/11/2018 Updated: 29/08/2022

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nodejs node.js
suse suse linux enterprise server 12
suse suse enterprise storage 4
suse suse openstack cloud 7
suse suse openstack cloud 8
suse suse linux enterprise server 15

Synopsis Important: rh-nodejs8-nodejs security update Type/Severity Security Advisory: Important Topic An update for rh-nodejs8-nodejs is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Generates payload for request splitting in Node 8.x and 6.x

Unicode SSRF payload concealer Kudos The scripts in this repo is a result of following wwwrfkidau/blog/entry/security-bugs-ssrf-via-request-splitting/ guide for a CTF about HTTP request splitting (CVE-2018-12116) Main idea The idea is to smuggle http request (inject it into another one) by passing it as another request's parameter, but hiding it from http modul

Generates payload for request splitting in Node 8.x and 6.x

Unicode SSRF payload concealer Kudos The scripts in this repo is a result of following wwwrfkidau/blog/entry/security-bugs-ssrf-via-request-splitting/ guide for a CTF about HTTP request splitting (CVE-2018-12116) Main idea The idea is to smuggle http request (inject it into another one) by passing it as another request's parameter, but hiding it from http modul

NVD-CWE-Other https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/https://access.redhat.com/errata/RHSA-2019:1821 https://security.gentoo.org/glsa/202003-48 https://access.redhat.com/errata/RHSA-2019:1821 https://nvd.nist.gov https://github.com/subatiq/Unicode-SSRF

CVE-2018-12116

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect