CVE-2022-43548

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
NodeJS	Node	>= 4.0, < 4.; >= 5.0, < 5.; >= 6.0, < 6.; >= 7.0, < 7.; >= 8.0, < 8.; >= 9.0, < 9.; >= 10.0, < 10.; >= 11.0, < 11.; >= 12.0, < 12.; >= 13.0, < 13.; >= 14.0, < 14.21.1; >= 15.0, < 15.; >= 16.0, < 16.18.1; >= 17.0, < 17.; >= 18.0, < 18.12.1; >= 19.0, < 19.0.1

References

https://lists.debian.org/debian-lts-announce/2023/02/msg00038.htmlMailing List, Third Party Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230120-0004/Third Party Advisory
https://security.netapp.com/advisory/ntap-20230427-0007/
https://www.debian.org/security/2023/dsa-5326Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.htmlMailing List, Third Party Advisory
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230120-0004/Third Party Advisory
https://security.netapp.com/advisory/ntap-20230427-0007/
https://www.debian.org/security/2023/dsa-5326Third Party Advisory

Timeline

Published: Dec 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-435499.8Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.CVE-2022-43557.2The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2022-435509.8A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows CVE-2022-435517.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be CVE-2022-435525.9A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP pro CVE-2022-435538.8A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account CVE-2022-435547.8Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability CVE-2022-435557.8Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability CVE-2022-435566.1Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result das CVE-2022-435575.3The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with phy CVE-2022-43567.2The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading CVE-2022-435614.8In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts t