VDB
CVE-2021-22921
CVE-2021-22921
PUBLISHED
CVSS 7.800000190734863 HIGH
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
EPSS 7.41% · 94.2th percentile
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
7.41%
94.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 12.0.0, 16.0.0, 14.0.0 |
| Bitnami | node-min | 16.0.0, 14.0.0, 14.0.0 |
| Bitnami | node-min | 12.0.0, 14.0.0, 16.0.0 |
| Bitnami | node | 12.0.0, 14.0.0, 16.0.0 |
Timeline
- CVE Published
- Jul 1, 2021 PoC Published
- Jul 13, 2021 EPSS Score
- Jul 16, 2021 EPSS Score
- Aug 6, 2021 EPSS Score
- Nov 10, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 8, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 8, 2022 EPSS Score
- Jul 7, 2022 EPSS Score