VDB
CVE-2023-32558
CVE-2023-32558
PUBLISHED
CVSS 8.699999809265137 HIGH
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
EPSS 0.19% · 41.1th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.19%
41.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node-min | 20.0.0, 20.0.0, 20.0.0 |
| Bitnami | node-min | 20.0.0 |
| Bitnami | node | 20.0.0 |
Exploit Intelligence
Timeline
- CVE Published
- Sep 10, 2023 PoC Published
- Sep 12, 2023 EPSS Score
- Oct 14, 2023 EPSS Score
- Dec 18, 2023 EPSS Score
- Jan 20, 2024 EPSS Score
- Feb 21, 2024 EPSS Score
- Mar 25, 2024 EPSS Score
- May 29, 2024 EPSS Score
- Jun 30, 2024 EPSS Score
- Aug 1, 2024 EPSS Score
- Sep 3, 2024 EPSS Score