CVE-2021-22921

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/204785
• https://www.ibm.com/support/pages/node/6570957 (Advisory)
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://hackerone.com/reports/1211160
• https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
• https://security.netapp.com/advisory/ntap-20210805-0003/

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6570957

Frequently Asked Questions

• What is CVE-2021-22921?

  CVE-2021-22921 is a vulnerability in Node.js that could allow a local attacker to gain elevated privileges on the system.

• How does CVE-2021-22921 work?

  CVE-2021-22921 is caused by improper configuration of permissions in the installation directory of Node.js, which can be exploited by a local attacker to perform PATH and DLL hijacking attacks.

• What is the severity of CVE-2021-22921?

  CVE-2021-22921 has a severity rating of high, with a CVSS score of 7.4.

• How can CVE-2021-22921 be exploited?

  CVE-2021-22921 can be exploited by a local attacker who has access to the installation directory of Node.js, allowing them to manipulate the PATH environment variable and potentially execute malicious code.

• Is there a fix for CVE-2021-22921?

  To fix CVE-2021-22921, it is recommended to update Node.js to the latest version and ensure proper configuration of permissions in the installation directory.