CVE-2023-30584: Path traversal bypass in experimental permission model
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass when verifying file permissions. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-30584?
CVE-2023-30584 has been classified with a moderate severity due to its potential impact on file permission verification.
How do I fix CVE-2023-30584?
To address CVE-2023-30584, it is recommended to upgrade to a later version of Node.js that resolves the experimental permission model flaw.
What software is affected by CVE-2023-30584?
CVE-2023-30584 specifically affects Node.js version 20 and could impact applications dependent on this version.
What type of vulnerability is CVE-2023-30584?
CVE-2023-30584 is a path traversal vulnerability that occurs due to improper handling of file permissions.
Is the permission model in Node.js stable with CVE-2023-30584?
At the time of this CVE, the permission model in Node.js is experimental, which contributes to the vulnerability concerns.