Vulnerability-Lookup

CVE-2021-4229 (GCVE-0-2021-4229)

Vulnerability from cvelistv5 – Published: 2022-05-24 15:30 – Updated: 2025-04-15 14:38

Title

ua-parser-js Crypto Mining backdoor

Summary

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-912 - Backdoor

Assigner

VulDB

References

3 references

URL	Tags
https://github.com/advisories/GHSA-pjwm-rvh2-c87w	x_refsource_MISC
https://github.com/faisalman/ua-parser-js/issues/536	x_refsource_MISC
https://vuldb.com/?id.185453	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
unspecified	ua-parser-js	Affected: 0.7.29 Affected: 0.8.0 Affected: 1.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:23:08.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/faisalman/ua-parser-js/issues/536"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.185453"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-4229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T17:14:48.297471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T14:38:30.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ua-parser-js",
          "vendor": "unspecified",
          "versions": [
            {
              "status": "affected",
              "version": "0.7.29"
            },
            {
              "status": "affected",
              "version": "0.8.0"
            },
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-912",
              "description": "CWE-912 Backdoor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-24T15:30:35.000Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/faisalman/ua-parser-js/issues/536"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://vuldb.com/?id.185453"
        }
      ],
      "title": "ua-parser-js Crypto Mining backdoor",
      "x_generator": "vuldb.com",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@vuldb.com",
          "ID": "CVE-2021-4229",
          "REQUESTER": "cna@vuldb.com",
          "STATE": "PUBLIC",
          "TITLE": "ua-parser-js Crypto Mining backdoor"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ua-parser-js",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "0.7.29"
                          },
                          {
                            "version_value": "0.8.0"
                          },
                          {
                            "version_value": "1.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": ""
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
            }
          ]
        },
        "generator": "vuldb.com",
        "impact": {
          "cvss": {
            "baseScore": "5.0",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-912 Backdoor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
              "refsource": "MISC",
              "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
            },
            {
              "name": "https://github.com/faisalman/ua-parser-js/issues/536",
              "refsource": "MISC",
              "url": "https://github.com/faisalman/ua-parser-js/issues/536"
            },
            {
              "name": "https://vuldb.com/?id.185453",
              "refsource": "MISC",
              "url": "https://vuldb.com/?id.185453"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2021-4229",
    "datePublished": "2022-05-24T15:30:35.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-15T14:38:30.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-4229",
      "date": "2026-05-27",
      "epss": "0.00863",
      "percentile": "0.75328"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.7.29:*:*:*:*:node.js:*:*\", \"matchCriteriaId\": \"381C07EB-1848-4B09-B7AA-F069D666973D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.8.0:*:*:*:*:node.js:*:*\", \"matchCriteriaId\": \"207BD461-40FD-46B2-BB75-5580E56AA6D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ua-parser-js_project:ua-parser-js:1.0.0:*:*:*:*:node.js:*:*\", \"matchCriteriaId\": \"03BA6112-C319-430C-9045-938EC96DA38A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.\"}, {\"lang\": \"es\", \"value\": \"Se ha encontrado una vulnerabilidad en ua-parser-js versiones 0.7.29/0.8.0/1.0.0. Ha sido calificada como cr\\u00edtica. Este problema afecta al componente de miner\\u00eda de criptomonedas que introduce una puerta trasera. La actualizaci\\u00f3n a versiones 0.7.30, 0.8.1 y 1.0.1 puede abordar este problema. Es recomendado actualizar el componente afectado\"}]",
      "id": "CVE-2021-4229",
      "lastModified": "2024-11-21T06:37:11.567",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@vuldb.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L\", \"baseScore\": 5.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 3.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:H/Au:N/C:C/I:C/A:C\", \"baseScore\": 7.6, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"HIGH\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 4.9, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2022-05-24T16:15:07.680",
      "references": "[{\"url\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"source\": \"cna@vuldb.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"source\": \"cna@vuldb.com\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://vuldb.com/?id.185453\", \"source\": \"cna@vuldb.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://vuldb.com/?id.185453\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "cna@vuldb.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cna@vuldb.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-912\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-829\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-4229\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2022-05-24T16:15:07.680\",\"lastModified\":\"2024-11-21T06:37:11.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado una vulnerabilidad en ua-parser-js versiones 0.7.29/0.8.0/1.0.0. Ha sido calificada como cr\u00edtica. Este problema afecta al componente de miner\u00eda de criptomonedas que introduce una puerta trasera. La actualizaci\u00f3n a versiones 0.7.30, 0.8.1 y 1.0.1 puede abordar este problema. Es recomendado actualizar el componente afectado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:C/I:C/A:C\",\"baseScore\":7.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":4.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-912\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-829\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.7.29:*:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"381C07EB-1848-4B09-B7AA-F069D666973D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.8.0:*:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"207BD461-40FD-46B2-BB75-5580E56AA6D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ua-parser-js_project:ua-parser-js:1.0.0:*:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"03BA6112-C319-430C-9045-938EC96DA38A\"}]}]}],\"references\":[{\"url\":\"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/faisalman/ua-parser-js/issues/536\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://vuldb.com/?id.185453\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/faisalman/ua-parser-js/issues/536\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://vuldb.com/?id.185453\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?id.185453\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T17:23:08.902Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-4229\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-14T17:14:48.297471Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-14T17:14:49.669Z\"}}], \"cna\": {\"title\": \"ua-parser-js Crypto Mining backdoor\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"unspecified\", \"product\": \"ua-parser-js\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.7.29\"}, {\"status\": \"affected\", \"version\": \"0.8.0\"}, {\"status\": \"affected\", \"version\": \"1.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://vuldb.com/?id.185453\", \"tags\": [\"x_refsource_MISC\"]}], \"x_generator\": \"vuldb.com\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-912\", \"description\": \"CWE-912 Backdoor\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2022-05-24T15:30:35.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"version\": \"3.1\", \"baseScore\": \"5.0\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L\"}}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"0.7.29\"}, {\"version_value\": \"0.8.0\"}, {\"version_value\": \"1.0.0\"}]}, \"product_name\": \"ua-parser-js\"}]}, \"vendor_name\": \"\"}]}}, \"data_type\": \"CVE\", \"generator\": \"vuldb.com\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"name\": \"https://github.com/advisories/GHSA-pjwm-rvh2-c87w\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"name\": \"https://github.com/faisalman/ua-parser-js/issues/536\", \"refsource\": \"MISC\"}, {\"url\": \"https://vuldb.com/?id.185453\", \"name\": \"https://vuldb.com/?id.185453\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-912 Backdoor\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2021-4229\", \"STATE\": \"PUBLIC\", \"TITLE\": \"ua-parser-js Crypto Mining backdoor\", \"ASSIGNER\": \"cna@vuldb.com\", \"REQUESTER\": \"cna@vuldb.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-4229\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-15T14:38:30.138Z\", \"dateReserved\": \"2022-05-24T00:00:00.000Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2022-05-24T15:30:35.000Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2021-4229

Vulnerability from fkie_nvd - Published: 2022-05-24 16:15 - Updated: 2024-11-21 06:37

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cna@vuldb.com	https://github.com/advisories/GHSA-pjwm-rvh2-c87w	Third Party Advisory
cna@vuldb.com	https://github.com/faisalman/ua-parser-js/issues/536	Issue Tracking, Patch, Third Party Advisory
cna@vuldb.com	https://vuldb.com/?id.185453	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/advisories/GHSA-pjwm-rvh2-c87w	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/faisalman/ua-parser-js/issues/536	Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://vuldb.com/?id.185453	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
ua-parser-js_project	ua-parser-js	0.7.29
ua-parser-js_project	ua-parser-js	0.8.0
ua-parser-js_project	ua-parser-js	1.0.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.7.29:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "381C07EB-1848-4B09-B7AA-F069D666973D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.8.0:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "207BD461-40FD-46B2-BB75-5580E56AA6D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:1.0.0:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "03BA6112-C319-430C-9045-938EC96DA38A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en ua-parser-js versiones 0.7.29/0.8.0/1.0.0. Ha sido calificada como cr\u00edtica. Este problema afecta al componente de miner\u00eda de criptomonedas que introduce una puerta trasera. La actualizaci\u00f3n a versiones 0.7.30, 0.8.1 y 1.0.1 puede abordar este problema. Es recomendado actualizar el componente afectado"
    }
  ],
  "id": "CVE-2021-4229",
  "lastModified": "2024-11-21T06:37:11.567",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.6,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-05-24T16:15:07.680",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/faisalman/ua-parser-js/issues/536"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?id.185453"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/faisalman/ua-parser-js/issues/536"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?id.185453"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-912"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-236C-VHJ4-GFXG

Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2026-02-17 21:40

Summary

Duplicate Advisory: Embedded malware in ua-parser-js

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pjwm-rvh2-c87w. This link is maintained to preserve external references.

Original Description

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.29"
            },
            {
              "fixed": "0.7.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.7.29"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "0.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.0"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-912"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T21:40:20Z",
    "nvd_published_at": "2022-05-24T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pjwm-rvh2-c87w. This link is maintained to preserve external references.\n\n### Original Description\nA vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.",
  "id": "GHSA-236c-vhj4-gfxg",
  "modified": "2026-02-17T21:40:20Z",
  "published": "2022-05-25T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4229"
    },
    {
      "type": "WEB",
      "url": "https://github.com/faisalman/ua-parser-js/issues/536"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.185453"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Embedded malware in ua-parser-js",
  "withdrawn": "2026-02-17T21:40:20Z"
}

GHSA-PJWM-RVH2-C87W

Vulnerability from github – Published: 2021-10-22 20:38 – Updated: 2026-02-17 21:57

Summary

Embedded malware in ua-parser-js

Details

The npm package ua-parser-js had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See this issue for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.7.29"
            },
            {
              "fixed": "0.7.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.7.29"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "0.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8.0"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "ua-parser-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-912"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-22T20:37:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
  "id": "GHSA-pjwm-rvh2-c87w",
  "modified": "2026-02-17T21:57:43Z",
  "published": "2021-10-22T20:38:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/faisalman/ua-parser-js/issues/536"
    },
    {
      "type": "WEB",
      "url": "https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/faisalman/ua-parser-js"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/ua-parser-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Embedded malware in ua-parser-js"
}

GSD-2021-4229

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-4229

Aliases

CVE-2021-4229

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-4229",
    "description": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.",
    "id": "GSD-2021-4229"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-4229"
      ],
      "details": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.",
      "id": "GSD-2021-4229",
      "modified": "2023-12-13T01:23:11.496807Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@vuldb.com",
        "ID": "CVE-2021-4229",
        "REQUESTER": "cna@vuldb.com",
        "STATE": "PUBLIC",
        "TITLE": "ua-parser-js Crypto Mining backdoor"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ua-parser-js",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "0.7.29"
                        },
                        {
                          "version_value": "0.8.0"
                        },
                        {
                          "version_value": "1.0.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": ""
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
          }
        ]
      },
      "generator": "vuldb.com",
      "impact": {
        "cvss": {
          "baseScore": "5.0",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-912 Backdoor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
            "refsource": "MISC",
            "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
          },
          {
            "name": "https://github.com/faisalman/ua-parser-js/issues/536",
            "refsource": "MISC",
            "url": "https://github.com/faisalman/ua-parser-js/issues/536"
          },
          {
            "name": "https://vuldb.com/?id.185453",
            "refsource": "MISC",
            "url": "https://vuldb.com/?id.185453"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "=1.0.0||=0.8.0||=0.7.29",
          "affected_versions": "Version 1.0.0, version 0.8.0, version 0.7.29",
          "cvss_v2": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-829",
            "CWE-937"
          ],
          "date": "2022-06-06",
          "description": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.",
          "fixed_versions": [
            "0.7.30",
            "0.8.1",
            "1.0.1"
          ],
          "identifier": "CVE-2021-4229",
          "identifiers": [
            "CVE-2021-4229",
            "GHSA-pjwm-rvh2-c87w"
          ],
          "not_impacted": "",
          "package_slug": "npm/ua-parser-js",
          "pubdate": "2022-05-24",
          "solution": "Upgrade to versions 0.7.30, 0.8.1, 1.0.1 or above.",
          "title": "Inclusion of Functionality from Untrusted Control Sphere",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-4229",
            "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
            "https://vuldb.com/?id.185453",
            "https://github.com/faisalman/ua-parser-js/issues/536"
          ],
          "uuid": "88f28a01-8ace-4728-9fa0-b76cad0753a0"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:1.0.0:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.8.0:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ua-parser-js_project:ua-parser-js:0.7.29:*:*:*:*:node.js:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@vuldb.com",
          "ID": "CVE-2021-4229"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-829"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
            },
            {
              "name": "https://vuldb.com/?id.185453",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://vuldb.com/?id.185453"
            },
            {
              "name": "https://github.com/faisalman/ua-parser-js/issues/536",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/faisalman/ua-parser-js/issues/536"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 4.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-06-06T14:23Z",
      "publishedDate": "2022-05-24T16:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-4229 (GCVE-0-2021-4229)

FKIE_CVE-2021-4229

GHSA-236C-VHJ4-GFXG

Duplicate Advisory

Original Description

GHSA-PJWM-RVH2-C87W

GSD-2021-4229

Tags

Sightings

Nomenclature