BIT-node-2023-32003

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/node/BIT-node-2023-32003.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-node-2023-32003
Aliases
Published
2024-03-06T11:00:26.469Z
Modified
2024-10-02T07:52:37.481Z
Summary
[none]
Details

fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.This vulnerability affects all users using the experimental permission model in Node.js 20.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Database specific
{
    "cpes": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / node

Package

Name
node
Purl
pkg:bitnami/node

Severity

  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
20.0.0
Fixed
20.5.1