CVE-2024-37372 — Vulnetix

Try Vulnetix Request Demo

CVE-2024-37372 PUBLISHED

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

EPSS 0.05% · 15.1th percentile

Risk Scores

EPSS Score

0.05%

15.1th percentile

Affected Products

Vendor	Product	Versions
Bitnami	node	21.0.0, 21.0.0, 19.0.0
Bitnami	node	19.0.0, 21.0.0
Bitnami	node-min	19.0.0, 21.0.0
Bitnami	node-min	19.0.0, 21.0.0, 19.0.0

Timeline

CVE Published
Jul 15, 2024 PoC Published
Jan 9, 2025 EPSS Score
Jan 24, 2025 EPSS Score
Feb 8, 2025 EPSS Score
Feb 24, 2025 EPSS Score
Mar 5, 2025 Coalition ESS Score
Mar 11, 2025 EPSS Score
Mar 26, 2025 EPSS Score
Apr 10, 2025 EPSS Score
Apr 25, 2025 EPSS Score
May 10, 2025 EPSS Score

References

Open in Interactive Console →