CVE-2022-21208
Published: 23 August 2022
Summary
CVE-2022-21208 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Node-Opcua Project Node-Opcua. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6479
Vulnerability details
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability…
more
by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.