Ubuntu.comUB:CVE-2023-32004CVE-2023-32004
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
28.5%
A vulnerability has been discovered in Node.js version 20, specifically
within the experimental permission model. This flaw relates to improper
handling of Buffers in file system APIs causing a traversal path to bypass
when verifying file permissions. This vulnerability affects all users using
the experimental permission model in Node.js 20. Please note that at the
time this CVE was issued, the permission model is an experimental feature
of Node.js.
Notes
| Author | Note |
|---|---|
| sbeattie | experimental permissions model was introduced in Node.js 20 |
References
launchpad.net/bugs/cve/CVE-2023-32004
nodejs.org/en/blog/vulnerability/august-2023-security-releases#permission-model-bypass-by-specifying-a-path-traversal-sequence-in-a-buffer-highcve-2023-32004
nvd.nist.gov/vuln/detail/CVE-2023-32004
security-tracker.debian.org/tracker/CVE-2023-32004
www.cve.org/CVERecord?id=CVE-2023-32004
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
28.5%