CVE-2021-22921
First published: Mon Jul 12 2021(Updated: )
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nodejs Node.js | >=12.0.0<12.22.2 | |
| Nodejs Node.js | >=14.0.0<14.17.2 | |
| Nodejs Node.js | >=16.0.0<16.4.1 | |
| Microsoft Windows | ||
| Siemens Sinec Infrastructure Network Services | <1.0.1.1 | |
| IBM Cognos Controller | <=11.0.0 - 11.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-22921?
CVE-2021-22921 is a vulnerability in Node.js that could allow a local attacker to gain elevated privileges on the system.
How does CVE-2021-22921 work?
CVE-2021-22921 is caused by improper configuration of permissions in the installation directory of Node.js, which can be exploited by a local attacker to perform PATH and DLL hijacking attacks.
What is the severity of CVE-2021-22921?
CVE-2021-22921 has a severity rating of high, with a CVSS score of 7.4.
How can CVE-2021-22921 be exploited?
CVE-2021-22921 can be exploited by a local attacker who has access to the installation directory of Node.js, allowing them to manipulate the PATH environment variable and potentially execute malicious code.
Is there a fix for CVE-2021-22921?
To fix CVE-2021-22921, it is recommended to update Node.js to the latest version and ensure proper configuration of permissions in the installation directory.
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/12.0.0
- version/nodejs node.js/14.0.0
- version/nodejs node.js/16.0.0
- vendor/microsoft
- canonical/microsoft windows
- vendor/siemens
- canonical/siemens sinec infrastructure network services
- vendor/ibm
- canonical/ibm cognos controller
- version/ibm cognos controller/11.0.0 - 11.0.1