CVE-2018-12120CWE-419CWE-829

CVE-2018-12120

High · published November 28, 2018

CVSS v3.1
8.1
EPSS
4%
Percentile
91.1
In the wild
Unconfirmed
What it is

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04277 · 91.1th percentile
Weaknesses
CWE-419 · Unprotected Primary Channel; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2018-11-28T22:29Z
Affected products (1)
ProductVersionsFixed in
nodejs/node.js≥ 6.0.0, < 6.15.06.15.0
References (4)
http://www.securityfocus.com/bid/106040 · [email protected]https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · [email protected]http://www.securityfocus.com/bid/106040 · af854a3a-2127-422b-91ae-364da2661108https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 NOV 17:00Z
    Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or…
    cvelistv5