QwikSec

Security Database

CVE

CWE

Training

CVE-2021-21297

Published: Feb 26, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

7.7

HIGH

Description

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url.

Vendor	Product	Versions
node-red	node-red	affected `< 1.2.8`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

References

https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67

x_refsource_CONFIRM

https://www.npmjs.com/package/%40node-red/runtime

x_refsource_MISC

https://www.npmjs.com/package/%40node-red/editor-api

x_refsource_MISC

https://github.com/node-red/node-red/releases/tag/1.2.8

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.