CVE-2023-39331
Summary
| CVE | CVE-2023-39331 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-10-18 04:15:00 UTC |
| Updated | 2023-11-17 19:10:00 UTC |
| Description | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| HackerOne | MISC | hackerone.com | |
| security.netapp.com/advisory/ntap-20231116-0009 | security.netapp.com | Third Party Advisory | |
| [SECURITY] Fedora 37 Update: nodejs20-20.8.1-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 38 Update: nodejs20-20.8.1-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 39 Update: nodejs20-20.8.1-1.fc39 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161192 Oracle Enterprise Linux Security Update for nodejs:20 (ELSA-2023-7205)
- 242429 Red Hat Update for nodejs:20 (RHSA-2023:7205)
- 284672 Fedora Security Update for nodejs20 (FEDORA-2023-f66fc0f62a)
- 284673 Fedora Security Update for nodejs20 (FEDORA-2023-4d2fd884ea)
- 285187 Fedora Security Update for nodejs20 (FEDORA-2023-7b52921cae)
- 296106 Oracle Solaris 11.4 Support Repository Update (SRU) 64.157.2 Missing (CPUOCT2023)
- 378951 Node.js Multiple Security Vulnerabilties (October 13, 2023 Security Release)
- 503388 Alpine Linux Security Update for nodejs-current
- 506129 Alpine Linux Security Update for nodejs-current
- 941479 AlmaLinux Security Update for nodejs:20 (ALSA-2023:7205)
- 961085 Rocky Linux Security Update for nodejs:20 (RLSA-2023:7205)