Improper Certificate Validation in node-XMLHttpRequest - CVE-2021-31597
Published: May 16, 2023
Vulnerability identifier: #VU76190
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-31597
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform MitM attacks.
The vulnerability exists due to improper certificate validation caused by an error interpreting the rejectUnauthorized value. A remote attacker can perform a man-in-the-middle (MitM) attack.
Affected software
node-XMLHttpRequest
IBM Cloud Transformation Advisor
IBM Cloud Automation Manager
Jira Service Management Data Center
IBM Cloud Transformation Advisor
IBM Cloud Automation Manager
Jira Service Management Data Center
How to mitigate CVE-2021-31597
Install updates from vendor's website.
node-XMLHttpRequest - update to 1.6.1
Jira Service Management Data Center - update to 11.3.4
Jira Service Management Data Center - update to 11.3.4