Vulnerability CVE-2021-23406
Published: 2021-08-24

Description:
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

Type:

NVD-CWE-noinfo

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Pac-resolver project -> Pac-resolver 

 References:
https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9e
https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506
https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0
https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857
Copyright 2024, cxsecurity.com

 

Back to Top