Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2021-22921

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

  • Published: Jul 12, 2021
  • Updated: Apr 14, 2023
  • CVE: CVE-2021-22921
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Low
  • Score: 4.4
  • AV:L/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
nodejs / node.js 12.0.0 12.22.2
nodejs / node.js 14.0.0 14.17.2
nodejs / node.js 16.0.0 16.4.1
siemens / sinec_infrastructure_network_services - 1.0.1.1