PT-2018-6055 · Node.Js+1 · Sync-Exec+1
Maxnikulin
·
Publicado
2016-02-10
·
Atualizado
2019-10-09
·
CVE-2017-16024
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
sync-exec versions prior to 0.11.9
Description:
The issue allows an attacker with low privileges on the server to potentially obtain confidential information from the buffer/tmp file used by the sync-exec module. This is because the tmp directory, where the buffer files are stored, has world-readable permissions, making it accessible to other users on the system.
Recommendations:
For sync-exec versions prior to 0.11.9, update to Node.js v0.12.0 or later and migrate all uses of sync-exec to child process.execSync().
Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Sync-Exec