What is CVE-2022-32210?

CVE-2022-32210 is a medium-severity vulnerability in Node.js Undici, classified under Improper Certificate Validation. CVSS score: 6.5/10. Published 2022-07-14.

How severe is CVE-2022-32210?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Node.js Undici

CVE-2022-32210

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Vulnerability class: Improper Certificate Validation

EPSS: 0.004 (36.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Nodejs Undici
N/a Https://github.com/nodejs/undici — versions Fixed in version >= v5.5.1. Vulnerable between v4.8.2 and v5.5.0

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-32210?: CVE-2022-32210 is a medium-severity vulnerability in Node.js Undici, classified under Improper Certificate Validation. CVSS score: 6.5/10. Published 2022-07-14.
How severe is CVE-2022-32210?: Medium severity. CVSS v3 base score is 6.5 out of 10.