VDB
CVE-2023-32558
CVE-2023-32558
PUBLISHED
CVSS 7.5 HIGH
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
EPSS 1.74% · 77.6th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
1.74%
77.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node-min | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node-min | 20.0.0 |
| Bitnami | node | 20.0.0 |
Timeline
- CVE Published
- Sep 10, 2023 PoC Published
- Sep 12, 2023 EPSS Score
- Oct 15, 2023 EPSS Score
- Dec 20, 2023 EPSS Score
- Jan 22, 2024 EPSS Score
- Feb 24, 2024 EPSS Score
- Apr 30, 2024 EPSS Score
- Jun 3, 2024 EPSS Score
- Jul 6, 2024 EPSS Score
- Aug 8, 2024 EPSS Score
- Oct 13, 2024 EPSS Score