PT-2023-4523 · Node.Js · Node.Js
Axel Chong
·
Publicado
2023-06-20
·
Atualizado
2024-12-16
·
CVE-2023-30584
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js version 20
Description
A vulnerability has been discovered in Node.js, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. The vulnerability may allow a remote attacker to impact the integrity of protected information due to incorrect restriction of the directory path name with limited access.
Recommendations
For Node.js version 20, as a temporary workaround, consider disabling the experimental permission model until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the vulnerable permission model in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Node.Js