CVE-2018-12123 Other in Node.js
Attackers can spoof hostnames in javascript protocol URLs, potentially bypassing security checks in Node.js applications relying on url.parse().
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-12123?
CVE-2018-12123 is a medium-severity vulnerability in Nodejs Node.js, published on 28 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
Which versions are affected by CVE-2018-12123?
It affects 1 product.
Products include Nodejs Node.js.
How do I fix CVE-2018-12123?
Upgrade to a fixed version.
Is CVE-2018-12123 being exploited?
There is no known exploitation of CVE-2018-12123 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2018-12123, CLEANSTART-2026-BN32987, CLEANSTART-2026-NU24041, DEBIAN-CVE-2018-12123, GHSA-f6m9-hpfw-xjw4, UBUNTU-CVE-2018-12123.