Vulnerability · Published Apr 22, 2021 · Assigned by mitre
CVE-2021-31597
Critical 9.4
In plain English
A critical-severity security flaw in the xmlhttprequest-ssl package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.4Critical
Exploit odds (30 days)2.0%top 18.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | xmlhttprequest-ssl | 1.6.1 | GHSA-72mh-269x-7mh5 |
Affected products (as reported)
References
- https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt x_refsource_MISC
- https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1 x_refsource_MISC
- https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210618-0004/ x_refsource_CONFIRM