CVE-2018-12120 Misconfiguration in Node.js

What is CVE-2018-12120?

CVE-2018-12120 is a high-severity vulnerability in Nodejs Node.js, published on 28 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Weakness: CWE-829, CWE-419

Which versions are affected by CVE-2018-12120?

It affects 1 product.

Products include Nodejs Node.js.

How do I fix CVE-2018-12120?

Upgrade to a fixed version.

Is CVE-2018-12120 being exploited?

There is no known exploitation of CVE-2018-12120 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Node.js

• CVE-2023-32002 Security feature bypass in Node Critical 9.8
• CVE-2016-6303 Integer overflow in n/a Critical 9.8
• CVE-2017-15896 Security feature bypass in Node.js Critical 9.1
• CVE-2018-7160 Server-side request forgery in Node.js High 8.8
• CVE-2024-21891 Path traversal in Node High 7.9

All Nodejs Node.js vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-12120, GHSA-8fqw-43x4-4q75.