CVE-2013-4116

2014-04-2214:23:34

CWE-59

redhat

web.nvd.nist.gov

cve-2013-4116

npm

node packaged modules

symlink attack

security vulnerability

nvd

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

AI Score

6.3

Confidence

Low

EPSS

Percentile

5.1%

JSON

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

Affected configurations

Nvd

Node

node_packaged_modules_projectnode_packaged_modulesRange<1.3.3node.js

VendorProductVersionCPE
node_packaged_modules_projectnode_packaged_modules*cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:*:*:*:*:*:node.js:*:*