CVE-2021-29418

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-294217.5models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.CVE-2021-294247.5The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strinCVE-2021-294254.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\fCVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisonCVE-2021-294287.8In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple CVE-2021-294295.5In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access informatCVE-2021-294307.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user couCVE-2021-294316.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter CVE-2021-294325.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email addressCVE-2021-294334.3Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoinCVE-2021-294344.8Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin iCVE-2021-294356.5trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an