Cyber Resilience

CVE-2021-22939

MediumPublic PoC

Published: 16 August 2021

Published
16 August 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0012 31.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22939 is a medium-severity Improper Certificate Validation (CWE-295) vulnerability in Nodejs Node.Js. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CWE(s)
CWE-295

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nodejs
node.js
12.0.0 — 12.22.5 · 14.0.0 — 14.17.5 · 16.0.0 — 16.6.2
oracle
graalvm
20.3.3, 21.2.0
oracle
jd edwards enterpriseone tools
≤ 9.2.6.1
oracle
mysql cluster
≤ 8.0.26
oracle
peoplesoft enterprise peopletools
8.57, 8.58, 8.59
netapp
nextgen api
all versions
siemens
sinec infrastructure network services
≤ 1.0.1.1
debian
debian linux
10.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-19 Component Authenticity
addresses: CWE-295

When certificates are used to establish component provenance, the control requires correct certificate validation procedures.

SC-17 Public Key Infrastructure Certificates
addresses: CWE-295

Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates.

SC-45 System Time Synchronization
addresses: CWE-295

Correct system time is required for proper enforcement of certificate notBefore/notAfter dates and time-based revocation checks.

References