CVE-2018-7160
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
CVE-2018-7160
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2018-7160
Node.js
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "The Node.js Project",
"product": "Node.js",
"versions": [
{
"status": "affected",
"version": "^6.0.0 || ^8.0.0 || ^9.0.0"
}
]
}
]- Related CVEs
- CVE-2018-7160
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #15936 · Revision 1
- Added to Heist Feed
- Publisher date