VDB

CVE-2023-32004

CVE-2023-32004 PUBLISHED CVSS 8.800000190734863 HIGH

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

EPSS 2.13% · 81.2th percentile

Risk Scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.13%
81.2th percentile

Affected Products

VendorProductVersions
Bitnaminode20.0.0
Bitnaminode20.0.0, 20.0.0, 20.0.0
Bitnaminode-min20.0.0, 20.0.0, 20.0.0
Bitnaminode-min20.0.0

Timeline

  • CVE Published
  • Aug 11, 2023 PoC Published
  • Aug 16, 2023 EPSS Score
  • Sep 19, 2023 EPSS Score
  • Oct 7, 2023 PoC Published
  • Oct 23, 2023 EPSS Score
  • Dec 29, 2023 EPSS Score
  • Feb 1, 2024 EPSS Score
  • Mar 6, 2024 EPSS Score
  • Apr 9, 2024 EPSS Score
  • Jun 15, 2024 EPSS Score
  • Jul 19, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›