[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNIzxEu74T3BkwLoRIIn3VyYutGZwsCgKmQNd2QEX6Pk":3,"g5a-risk:CVE-2021-44531":208},{"success":4,"data":5,"meta":206},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":25,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":80,"references":81,"referencesCount":111,"weaknesses":112,"weaknessesCount":121,"isActivelyExploited":122,"cisaInfo":25,"otxData":25,"relatedBlogPosts":123,"seoMetadata":124,"configurations":149,"relatedVendorCves":204,"notableEvents":205},"CVE-2021-44531","What is CVE-2021-44531?","Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js \u003C 12.22.9, \u003C 14.18.3, \u003C 16.13.2, and \u003C 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.","Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-con...","2022-02-24T19:15:09.313","2022-10-05T13:56:24.62",7.4,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":25,"CVSSMetricV2":28,"CVSSMetricV40":25},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":26,"ImpactScore":27},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"TemporalSeverity":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":23,"ModifiedAttackVector":25,"ModifiedAttackComplexity":25,"ModifiedPrivilegesRequired":25,"ModifiedUserInteraction":25,"ModifiedScope":25,"ModifiedConfidentialityImpact":25,"ModifiedIntegrityImpact":25,"ModifiedAvailabilityImpact":25,"EnvironmentalScore":25,"EnvironmentalSeverity":25},"3.1","NETWORK","HIGH","NONE","UNCHANGED",null,2.2,5.2,[29],{"Source":17,"Type":18,"CVSSData":30,"BaseSeverity":33,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":25,"ObtainAllPrivilege":25,"ObtainUserPrivilege":25,"ObtainOtherPrivilege":25,"UserInteractionRequired":25},{"Version":31,"VectorString":32,"AccessVector":21,"AccessComplexity":33,"Authentication":23,"ConfidentialityImpact":34,"IntegrityImpact":34,"AvailabilityImpact":23,"BaseScore":35,"BaseSeverity":25,"Exploitability":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"CollateralDamagePotential":25,"TargetDistribution":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":25,"EnvironmentalScore":25},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:P\u002FA:N","MEDIUM","PARTIAL",5.8,8.6,4.9,0.08373,[38,38,38,38,38,38,38],"High",[42,47,52,55,58,61,64,67,70,74,77],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"nodejs","node.js","*","cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",{"vendor":48,"product":49,"version":50,"criteria":51,"vulnerable":4},"oracle","graalvm","20.3.5","cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*",{"vendor":48,"product":49,"version":53,"criteria":54,"vulnerable":4},"21.3.1","cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*",{"vendor":48,"product":49,"version":56,"criteria":57,"vulnerable":4},"22.0.0.2","cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*",{"vendor":48,"product":59,"version":45,"criteria":60,"vulnerable":4},"mysql_connectors","cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*",{"vendor":48,"product":62,"version":45,"criteria":63,"vulnerable":4},"mysql_enterprise_monitor","cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",{"vendor":48,"product":65,"version":45,"criteria":66,"vulnerable":4},"mysql_server","cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",{"vendor":48,"product":68,"version":45,"criteria":69,"vulnerable":4},"mysql_workbench","cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",{"vendor":48,"product":71,"version":72,"criteria":73,"vulnerable":4},"peoplesoft_enterprise_peopletools","8.58","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",{"vendor":48,"product":71,"version":75,"criteria":76,"vulnerable":4},"8.59","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",{"vendor":48,"product":78,"version":45,"criteria":79,"vulnerable":4},"mysql_cluster","cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",11,[82,90,96,100,104,108],{"url":83,"source":84,"tags":85},"https:\u002F\u002Fhackerone.com\u002Freports\u002F1429694","Hackerone",[86,87,88,89],"Issue Tracking","Mitigation","Patch","Third Party Advisory",{"url":91,"source":92,"tags":93},"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Fjan-2022-security-releases\u002F","Nodejs",[94,95],"Release Notes","Vendor Advisory",{"url":97,"source":98,"tags":99},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20220325-0007\u002F","Netapp",[89],{"url":101,"source":102,"tags":103},"https:\u002F\u002Fwww.debian.org\u002Fsecurity\u002F2022\u002Fdsa-5170","Debian",[89],{"url":105,"source":106,"tags":107},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuapr2022.html","Oracle",[88,89],{"url":109,"source":106,"tags":110},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujul2022.html",[89],6,[113],{"id":114,"name":115,"description":116,"extendedDescription":117,"status":118,"abstraction":119,"structure":120},"CWE-295","Improper Certificate Validation","The product does not validate, or incorrectly validates, a certificate.","When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.","Draft","Base","Simple",1,false,[],{"title":125,"metaDescription":126,"keywords":127,"canonicalUrl":128,"structuredData":129},"What is CVE-2021-44531? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2021-44531, a high severity cyber security vulnerability from 2022. Accepting arbitrary Subject Alternative Name (SAN) types, u...","CVE-2021-44531, CVE-2021-44531 vulnerability, CVE-2021-44531 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, nodejs security, oracle security, node.js vulnerability, graalvm vulnerability, mysql_connectors vulnerability, mysql_enterprise_monitor vulnerability, mysql_server vulnerability","\u002Fwhat-is\u002Fcve-2021-44531",{"@context":130,"@type":131,"headline":125,"description":126,"datePublished":10,"dateModified":11,"author":132,"publisher":136,"about":140,"mainEntityOfPage":144,"articleSection":147,"keywords":148},"https:\u002F\u002Fschema.org","TechArticle",{"@type":133,"name":134,"url":135},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":133,"name":134,"url":135,"logo":137},{"@type":138,"url":139},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":141,"name":6,"description":142,"additionalType":143},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":145,"@id":146},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2021-44531","Cybersecurity","CVE-2021-44531, CVE-2021-44531 vulnerability, CVE-2021-44531 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[150,170,198],{"Operator":25,"Negate":25,"Nodes":151},[152],{"Operator":153,"Negate":25,"CPEMatch":154},"OR",[155,158,162,166],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":156,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":157,"VersionEndIncluding":25},"DAE16BC9-7B14-48DA-ADEB-D1898E0B9885","12.22.9",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":159,"VersionStartExcluding":25,"VersionStartIncluding":160,"VersionEndExcluding":161,"VersionEndIncluding":25},"8499B085-A803-4958-BB99-8E7FABB177BB","14.0.0","14.18.3",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":163,"VersionStartExcluding":25,"VersionStartIncluding":164,"VersionEndExcluding":165,"VersionEndIncluding":25},"113157AB-0571-4244-A857-ADE4F4EA1F11","16.0.0","16.13.2",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":167,"VersionStartExcluding":25,"VersionStartIncluding":168,"VersionEndExcluding":169,"VersionEndIncluding":25},"9DF5B801-BC99-4F91-B350-C14A5998532C","17.0.0","17.3.1",{"Operator":25,"Negate":25,"Nodes":171},[172],{"Operator":153,"Negate":25,"CPEMatch":173},[174,176,178,180,183,186,189,192,194,196],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":175,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"079F2588-2746-408B-9BB0-9A569289985B",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":177,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"51600424-E294-41E0-9C8B-12D0C3456027",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":179,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"C3D12B98-032F-49A6-B237-E0CAD32D9A25",{"Vulnerable":4,"Criteria":60,"MatchCriteriaID":181,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":182},"727AE4B8-ECED-4942-B378-AC869D39D8D0","8.0.28",{"Vulnerable":4,"Criteria":63,"MatchCriteriaID":184,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":185},"B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747","8.0.29",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":187,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":188},"361CAD5F-8866-44CC-A47E-C0E98A9FAABA","5.7.37",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":190,"VersionStartExcluding":25,"VersionStartIncluding":191,"VersionEndExcluding":25,"VersionEndIncluding":182},"3D713546-8144-491B-B3D9-FBE437E4A442","8.0.0",{"Vulnerable":4,"Criteria":69,"MatchCriteriaID":193,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":182},"7BDC629D-CC4C-4903-8A06-BF5823457996",{"Vulnerable":4,"Criteria":73,"MatchCriteriaID":195,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9",{"Vulnerable":4,"Criteria":76,"MatchCriteriaID":197,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"C8AF00C6-B97F-414D-A8DF-057E6BFD8597",{"Operator":25,"Negate":25,"Nodes":199},[200],{"Operator":153,"Negate":25,"CPEMatch":201},[202],{"Vulnerable":4,"Criteria":79,"MatchCriteriaID":203,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":185},"CDB1E9C2-30CD-4DD2-BB9F-AF59B8DA9B9E",[],[],{"lastModified":11,"cacheTime":207,"version":31},1792242256424,{"score":209,"band":210,"action":211,"scoredAt":212},47,"Medium","Plan remediation","2026-10-16T06:53:39.811955+00:00"]