PT-2023-24607 · Deno · Deno+1

Sylc · Publicado 2023-05-31 · Atualizado 2023-06-07 · CVE-2023-33966

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Deno versions 1.34.0 deno runtime versions 0.114.0

Description The issue affects outbound HTTP requests made using the built-in node:http or node:https modules, which are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are also subject to the issue.

Recommendations For Deno version 1.34.0, update to Deno v1.34.1. For deno runtime version 0.114.0, update to deno runtime 0.114.1.

Exploit

Correção

Incorrect Default Permissions

Improper Privilege Management

Enumeração de Fraquezas

CWE-276

CWE-269

Identificadores relacionados

CVE-2023-33966

GHSA-VC52-GWM3-8V2F

Produtos afetados

Deno

Eden Runtime

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33966.json · Exploit
• https://github.com/denoland/deno · Nota
• https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f · Aviso do Fabricante
• https://github.com/denoland/deno/releases/tag/v1.34.1 · Nota
• https://osv.dev/vulnerability/GHSA-vc52-gwm3-8v2f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33966 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33966 · Aviso do Fabricante