Vulnerability in NetApp Next Generation Application Programming Interface
CVE-2021-43616
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
EPSS: 0.026 (84.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Netapp Next_generation_application_programming_interface
- Npmjs Npm
- Fedoraproject Fedora — versions 35
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, Issue Tracking)
- cve@mitre.org (Product, Vendor Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org (Patch, Third Party Advisory)
- cve@mitre.org (vendor-advisory)
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
Frequently asked questions
- What is CVE-2021-43616?
- CVE-2021-43616 is a critical-severity vulnerability in NetApp Next Generation Application Programming Interface, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.0/10. Published 2021-11-13.
- How severe is CVE-2021-43616?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2021-43616 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.