Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2018-7160 PUBLISHED CVSS 8.800000190734863 HIGH

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

Risk Scores

CVSS v3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.19nodejs6.9.5-r1, 6.9.5-r0, 6.9.4-r1
Alpine:v3.17nodejs6.11.1-r2, 6.11.2-r0, 6.11.3-r0
Alpine:v3.16nodejs6.11.4-r0, 8.9.3-r1, 8.9.3-r0
Alpine:v3.18nodejs6.9.5-r1, 6.9.5-r0, 6.9.4-r1
Alpine:v3.20nodejs6.11.1-r1, 6.11.1-r0, 6.11.0-r0
Alpine:v3.11nodejs6.9.1-r1, 0, 4.4.3-r0
Alpine:v3.23nodejs0, 0, 0
Alpine:v3.15nodejs6.9.1-r1, 6.9.1-r0, 6.11.5-r0
Alpine:v3.21nodejs0, 0, 0
Alpine:v3.12nodejs0, 8.9.4-r0, 8.9.3-r1
Alpine:v3.14nodejs8.9.4-r0, 4.5.0-r0, 4.4.7-r0
Alpine:v3.13nodejs6.11.0-r0, 0, 4.4.3-r0
Alpine:v3.22nodejs0, 0, 0
Alpine:v3.9nodejs6.9.1-r1, 6.9.1-r0, 6.11.5-r0
Alpine:v3.8nodejs6.11.1-r1, 0, 4.4.3-r0
Alpine:v3.10nodejs0, 4.4.3-r0, 4.4.4-r0

Timeline

References

Open in Interactive Console →