Products
node-twain
- All versions
Source
report@snyk.io
Tags
CVE-2024-21525 details
Published : July 10, 2024, 5:15 a.m.
Last Modified : July 10, 2024, 5:15 a.m.
Last Modified : July 10, 2024, 5:15 a.m.
Description
All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8.3 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-703 | Improper Check or Handling of Exceptional Conditions | The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
Base Score
8.3
Exploitability Score
2.8
Impact Score
5.5
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
References
| URL | Source |
|---|---|
| https://gist.github.com/dellalibera/55b87634a6c360e5be22a715f0566c99 | report@snyk.io |
| https://security.snyk.io/vuln/SNYK-JS-NODETWAIN-6421153 | report@snyk.io |
This website uses the NVD API, but is not approved or certified by it.