PT-2024-5137 · Node.Js+1 · Node.Js+1

Tniessen · Published 2024-04-19 · Updated 2026-05-18 · CVE-2024-37372

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Node.js (affected versions not specified)

Description: The issue is related to the Permission Model in Node.js, which incorrectly assumes that any path starting with two backslashes has a four-character prefix that can be ignored. This subtle bug leads to vulnerable edge cases. The vulnerability is associated with errors in processing input data and can be exploited by a remote attacker to impact data integrity.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-264

CWE-22

Related Identifiers

BDU:2024-05684

BDU:2024-05685

BIT-NODE-2024-37372

BIT-NODE-MIN-2024-37372

CLEANSTART-2026-BD71263

CLEANSTART-2026-IS74202

CLEANSTART-2026-JR35772

CLEANSTART-2026-JY06700

CLEANSTART-2026-KN34553

CLEANSTART-2026-KZ45320

CLEANSTART-2026-LJ44720

CLEANSTART-2026-LN12820

CLEANSTART-2026-TX00223

CLEANSTART-2026-WI75198

CVE-2024-37372

MGASA-2024-0282

OPENSUSE-SU-2024:14214-1

OPENSUSE-SU-2024:14435-1

OPENSUSE-SU-2025:15802-1

SUSE-SU-2024:2543-1

SUSE-SU-2024:2574-1

Affected Products

Node.Js

Suse

References · 207

• https://nvd.nist.gov/vuln/detail/CVE-2021-22931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23918 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000168 · Security Note
• https://bdu.fstec.ru/vul/2024-05685 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27982 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9511 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2024-37372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0734 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37372 · Vendor Advisory