CVE-2021-22931: netapp active_iq_unified_manager Improper Null Termination
Vulnerability summary
CVE-2021-22931 is a critical (CVSS 9.8) Improper Null Termination vulnerability in netapp active_iq_unified_manager. EPSS estimates a 21.95% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 12Timeline
- 16-08-2021PublishedVulnerability first disclosed.
- 30-04-2025Last modifiedVulnerability information updated.
Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
21.95%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 21.95% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-170Improper Null TerminationThe product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp5 products
Oracle3 products
- graalvmEOL20.3.3 | 21.2.0
- mysql_cluster≤ 8.0.26
- peoplesoft_enterprise_peopletools8.57 | 8.58 | 8.59
Alpine2 products
- nodejs< 12.22.5-r0 | < 14.17.5-r0
- nodejs-current< 16.11.1-r0 | < 16.6.2-r0
Nodejs2 products
- node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.22.5 | ≥ 13.0, < 13.* | ≥ 14.0, < 14.17.5 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.6.2
- node.js≥ 12.0.0, ≤ 12.12.0 | ≥ 12.13.0, < 12.22.5 | ≥ 14.0.0, ≤ 14.14.0 | ≥ 14.15.0, < 14.17.5 | ≥ 16.0.0, < 16.6.2
Siemens1 product
Ubuntu1 product
- nodejs< 0.10.25~dfsg2-2ubuntu1.2+esm1 | < 4.2.6~dfsg-1ubuntu4.2+esm2 | < 8.10.0~dfsg-2ubuntu0.4+esm2 | < 10.19.0~dfsg-3ubuntu1.1 | < 12.22.9~dfsg-1ubuntu3
6 vendors · 14 products
References
14 links- security.netapp.com/advisory/ntap-20210923-0001/Third Party Advisory
- security.netapp.com/advisory/ntap-20211022-0003/Third Party Advisory
- www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- security.gentoo.org/glsa/202401-02Vendor Advisory
