The vulnerability of the experimental-permission configuration in the Node.js software platform allows a hacker to bypass security restrictions and gain unauthorized access to protected information.

🗓️ 29 Oct 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Experimental-permission flaw in Node.js lets attackers bypass path restrictions and access data.

Reporter	Title	Published	Views	Family All 81
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 9.0.1	16 Nov 202315:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Node.js vulnerabilities	31 Jan 202413:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	26 Sep 202308:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Node.js	29 Apr 202502:31	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to bypassing security restrictions due to multiple Node.js vulnerabilities	14 Sep 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	2 Oct 202320:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.13 and earlier	12 Oct 202319:11	–	ibm
AlpineLinux	CVE-2023-32004	15 Aug 202316:15	–	alpinelinux
Chainguard	CVE-2023-32004 vulnerabilities	15 Aug 202316:15	–	cgr

Vulners

Node

node.js node.jsRange20.0.0–20.5.1

OR

fedora fedoraMatch37

OR

fedora fedoraMatch38

Source	Link
nodejs	www.nodejs.org/en/blog/vulnerability/august-2023-security-releases
hackerone	www.hackerone.com/reports/2104564
hackerone	www.hackerone.com/reports/2038134
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-32004
access	www.access.redhat.com/security/cve/CVE-2023-32004
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
security	www.security.netapp.com/advisory/ntap-20230915-0009/
github	www.github.com/nodejs/node/commit/1f64147eb607f82060e08884f993597774c69280
nodejs	www.nodejs.org/api/cli.html

29 Oct 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 38.8

CVSS 29

EPSS0.00118

node javascript platform experimental permission flaw path restrictions unauthorized access security vulnerability restricted directory