The vulnerability of the Node.js software platform arises from incorrect restrictions on path names for directories with restricted access. This allows attackers to execute attacks by bypassing these paths.

🗓️ 03 Jun 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Node.js vulnerability: improper path handling on restricted directories enables bypass attacks.

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	1 Apr 202418:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation Fixes for May 2024.	15 Apr 202502:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	1 Mar 202419:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier	19 Mar 202420:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	15 Apr 202502:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	15 Apr 202502:40	–	ibm
FreeBSD	NodeJS -- Vulnerabilities	14 Feb 202400:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)	6 Mar 202400:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0247: nodejs:20 (ALINUX3-SA-2024:0247)	14 May 202500:00	–	nessus

Vulners

Node

node.js node.jsRange20.0–20.11.1

OR

node.js node.jsRange21.0–21.6.2

OR

red_hat red_hat_enterprise_linuxMatch8

OR

oracle oracle_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

OR

oracle oracle_linuxMatch9

Source	Link
oracle	www.oracle.com/security-alerts/linuxbulletinapr2024.html
access	www.access.redhat.com/security/cve/cve-2024-21891
vuldb	www.vuldb.com/sv/
hackerone	www.hackerone.com/reports/2259914
openwall	www.openwall.com/lists/oss-security/2024/03/11/1
safe-surf	www.safe-surf.ru/upload/VULN-new/VULN.2024-04-19.1.pdf
web	www.web.nvd.nist.gov/view/vuln/detail

03 Jun 2024 00:00Current

7High risk

Vulners AI Score7

CVSS 26.2

CVSS 37.9

EPSS0.01245

nodejs restricted directories path handling bypass attacks security vulnerability