CVE-2021-29418 Security feature bypass in n/a
Attackers can bypass IP-based access controls by exploiting improper input validation in the netmask Node.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29418?
CVE-2021-29418 is a medium-severity vulnerability in n/a, published on 30 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
Weakness: CWE-20
Which versions are affected by CVE-2021-29418?
It affects 1 product.
Products include Netmask Project Netmask.
How do I fix CVE-2021-29418?
Upgrade to a fixed version.
Is CVE-2021-29418 being exploited?
There is no known exploitation of CVE-2021-29418 in the wild and no public exploit code.