CVE-2023-23920

2023-02-2320:15:14

CWE-426

[email protected]

web.nvd.nist.gov

cve-2023-23920

node.js

untrusted search path

CVSS3

4.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

AI Score

5.8

Confidence

High

EPSS

Percentile

14.1%

JSON

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

Affected configurations

Nvd

Node

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange14.0.0–14.21.3lts

nodejsnode.jsRange16.0.0–16.12.0-

nodejsnode.jsRange16.0.0–16.19.1lts

nodejsnode.jsRange18.0.0–18.11.0-

nodejsnode.jsRange18.0.0–18.14.1lts

nodejsnode.jsRange19.0.0–19.6.1-

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodejs	node.js	*	cpe:2.3:a:nodejs:node.js:::::-:::*
nodejs	node.js	*	cpe:2.3:a:nodejs:node.js:::::lts:::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*