VDB
CVE-2023-30582
CVE-2023-30582
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
EPSS 0.58% · 45.8th percentile
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.58%
45.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node-min | 20.0.0 |
| Bitnami | node-min | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node | 20.0.0 |
Timeline
- CVE Published
- Jul 20, 2023 PoC Published
- Sep 8, 2024 EPSS Score
- Sep 29, 2024 EPSS Score
- Oct 19, 2024 EPSS Score
- Nov 9, 2024 EPSS Score
- Nov 29, 2024 EPSS Score
- Dec 21, 2024 EPSS Score
- Jan 11, 2025 EPSS Score
- Jan 31, 2025 EPSS Score
- Feb 21, 2025 EPSS Score
- Mar 13, 2025 EPSS Score