Unscored severity · published Aug 13, 2012
CVE-2012-2330
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain…
–
CVSS
2.6%
EPSS
No
On KEV
Description
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nodejs · Nodejs
through 0.6.16; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2330
blog.nodejs.org
http://blog.nodejs.org/2012/05/04/version-0-6-17-stable/
Vendor Advisory
http://secunia.com/advisories/49066
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/08/4
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/08/8
Exploit
https://github.com/joyent/node/commit/7b3fb22
Exploit
https://github.com/joyent/node/commit/c9a231d
More from Nodejs
9.8
CVE-2024-3566
Command injection vulnerability in programing languages on Microsoft Windows operating system.
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user
8.8
CVE-2024-21891
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to…
8.2
CVE-2024-27983
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside
8.1
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…