Vulnerability Details : CVE-2018-7160

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Published 2018-05-17 14:29:01
Updated 2022-08-16 13:01:01
Source Node.js
View at NVD,   CVE.org
Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2018-7160

Probability of exploitation activity in the next 30 days: 3.26%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 91 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2018-7160

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
 NIST

CWE ids for CVE-2018-7160

References for CVE-2018-7160

Products affected by CVE-2018-7160

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close