CVE-2021-29418

Description

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

Exploitation Probability

0.023

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1.6	Windows
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 10.15	Windows
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 10.11	Windows
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 11.1	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.2	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234