What is the CVSS score of CVE-2022-32210?

CVE-2022-32210 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2022-32210?

Yes, a public proof-of-concept exploit is available for CVE-2022-32210. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2022-32210?

Yes, a patch is available for CVE-2022-32210. Update the affected software to the latest version immediately.

Node.js CVE-2022-32210

Q: Which versions of Node.js are affected by CVE-2022-32210?

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy.. A patch is available.

MEDIUM

Improper Certificate Validation (CWE-295)

2022-07-14 support@hackerone.com

Information Disclosure Node.js Undici

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jul 14, 2022 - 15:15 nvd

MEDIUM 6.5

DescriptionNVD

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

AnalysisAI

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server. Affected products include: Nodejs Undici.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.