Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2020-8277

CVE information

Published

3 years ago

Last Modified

5 months ago

CVSSv2.0 Severity

Medium

CVSSv3.1 Severity

High

Impact Analysis

Share

Description

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1..

CVSSv2.0 Score

Severity
Medium
Base Score
5/10
Exploit Score
10/10
Access Vector
Network
Access Complexity
Low
Authentication Required
None
Impact Score
2.9/10
Confidentiality Impact
None
Availability Impact
Partial
Integrity Impact
None

CVSSv3.1 Score

Severity
High
Base Score
7.5/10
Exploit Score
3.9/10
Access Vector
Network
Access Complexity
Low
Privileges Required
None
Impact Score
3.6/10
Confidentiality Impact
None
Availability Impact
High
Integrity Impact
None
Scope
Unchanged
User Interaction
None

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Yes
15.0.0 15.2.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Yes
14.13.0 14.15.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Yes
12.16.3 12.19.1
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:*
  Yes
- -
cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*
  Yes
- -
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:
  Yes
- 9.2.6.0
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
  Yes
- 21.1.2
cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*
  Yes
- 1.16.0

References