CVE-2021-23400 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
snyk	CNA	6.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 67%

Affected Products (NVD)

Vendor	Product	Version
nodemailer	nodemailer	𝑥 < 6.6.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

node-nodemailer

bookworm	6.8.0+~6.4.6-1 fixed
bullseye	6.4.17-3 fixed
sid	6.9.16+~6.4.16-1 fixed
trixie	6.9.15+~6.4.16-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

node-nodemailer

bionic	dne
focal	needs-triage
groovy	ignored
hirsute	ignored
impish	ignored
jammy	needs-triage
kinetic	ignored
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	dne
xenial	ignored

Known Exploits!

Common Weakness Enumeration

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References

https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f

https://github.com/nodemailer/nodemailer/issues/1289

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415

https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f

https://github.com/nodemailer/nodemailer/issues/1289

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415