CVE-2018-12120

moderate-risk
Published 2018-11-28

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Do I need to act?

-
0.42% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Nodejs

References (4)

Third Party Advisory http://www.securityfocus.com/bid/106040
Patch https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Third Party Advisory http://www.securityfocus.com/bid/106040
Patch https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
31
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal