PT-2023-6419 · Node.Js+4 · Node.Js+4

Tniessen · Published 2023-10-17 · Updated 2024-12-16 · CVE-2023-39331

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Node.js (affected versions not specified)

Description The issue arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations, leading to a path traversal vulnerability. This vulnerability is related to an insufficient patch of a previously disclosed issue. The permission model, which is an experimental feature of Node.js, is involved in this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2023:7205

BDU:2023-07135

BIT-NODE-2023-39331

BIT-NODE-MIN-2023-39331

CESA-2023_7205

CVE-2023-39331

OPENSUSE-SU-2024:13337-1

RHSA-2023:7205

RHSA-2023_7205

RLSA-2023:7205

Affected Products

Almalinux

Centos

Node.Js

Red Hat

Rocky Linux

References · 54

• https://osv.dev/vulnerability/openSUSE-SU-2024:13337-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39331 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-39331 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:7205 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-39331 · Security Note
• https://osv.dev/vulnerability/BIT-node-min-2023-39331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39331 · Security Note
• https://errata.almalinux.org/8/ALSA-2023-7205.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/700173 · Security Note
• https://bdu.fstec.ru/vul/2023-07135 · Security Note
• https://osv.dev/vulnerability/RLSA-2023:7205 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39331 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39331 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2023-39331 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2023-10-18.1.pdf · Security Note