Vulnerabilities > CVE-2021-21298 - Unspecified vulnerability in Nodered Node-Red

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nodered

NVD

Published: 2021-02-26

Updated: 2024-11-21

Summary

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.

Vulnerable Configurations

Part	Description	Count
Application	Nodered Nodered Node RED 0.2.0 Nodered Node RED 0.3.0 Nodered Node RED 0.4.0 Nodered Node RED 0.5.0 Nodered Node RED 0.6.0 Nodered Node RED 0.7.0 Nodered Node RED 0.7.1 Nodered Node RED 0.7.2 Nodered Node RED 0.8.0 Nodered Node RED 0.8.1 Nodered Node RED 0.9.0 Nodered Node RED 0.9.1 Nodered Node RED 0.10.0 Nodered Node RED 0.10.1 Nodered Node RED 0.10.2 Nodered Node RED 0.10.3 Nodered Node RED 0.10.4 Nodered Node RED 0.10.6 Nodered Node RED 0.10.8 Nodered Node RED 0.10.9 Nodered Node RED 0.10.10 Nodered Node RED 0.11.0 Nodered Node RED 0.11.1 Nodered Node RED 0.11.2 Nodered Node RED 0.12.0 Nodered Node RED 0.12.1 Nodered Node RED 0.12.2 Nodered Node RED 0.12.3 Nodered Node RED 0.12.4 Nodered Node RED 0.12.5 Nodered Node RED 0.13.0 Nodered Node RED 0.13.1 Nodered Node RED 0.13.2 Nodered Node RED 0.13.3 Nodered Node RED 0.13.4 Nodered Node RED 0.14.0 Nodered Node RED 0.14.1 Nodered Node RED 0.14.2 Nodered Node RED 0.14.3 Nodered Node RED 0.14.4 Nodered Node RED 0.14.5 Nodered Node RED 0.14.6 Nodered Node RED 0.15.0 Nodered Node RED 0.15.1 Nodered Node RED 0.15.2 Nodered Node RED 0.15.3 Nodered Node RED 0.16.0 Nodered Node RED 0.16.1 Nodered Node RED 0.16.2 Nodered Node RED 0.17.0 Nodered Node RED 0.17.1 Nodered Node RED 0.17.2 Nodered Node RED 0.17.3 Nodered Node RED 0.17.4 Nodered Node RED 0.17.5 Nodered Node RED 0.18.0 Nodered Node RED 0.18.1 Nodered Node RED 0.18.2 Nodered Node RED 0.18.3 Nodered Node RED 0.18.4 Nodered Node RED 0.18.5 Nodered Node RED 0.18.6 Nodered Node RED 0.18.7 Nodered Node RED 0.19.0 Nodered Node RED 0.19.1 Nodered Node RED 0.19.2 Nodered Node RED 0.19.3 Nodered Node RED 0.19.4 Nodered Node RED 0.19.5 Nodered Node RED 0.19.6 Nodered Node RED 0.20.0 Nodered Node RED 0.20.1 Nodered Node RED 0.20.2 Nodered Node RED 0.20.3 Nodered Node RED 0.20.4 Nodered Node RED 0.20.5 Nodered Node RED 0.20.6 Nodered Node RED 0.20.7 Nodered Node RED 0.20.8 Nodered Node RED 1.0.0 Nodered Node RED 1.0.1 Nodered Node RED 1.0.2 Nodered Node RED 1.0.3	91

Summary

Vulnerable Configurations

References