CVE-2023-32004: Path Traversal
First published: Tue Aug 15 2023(Updated: )
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nodejs Node.js | >=20.0.0<=20.5.0 | |
| Fedoraproject Fedora | =37 | |
| Fedoraproject Fedora | =38 | |
| <=2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://hackerone.com/reports/2038134
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
- https://security.netapp.com/advisory/ntap-20230915-0009/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/262899
- https://www.ibm.com/support/pages/node/7096528 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this Node.js vulnerability?
The vulnerability ID for this Node.js vulnerability is CVE-2023-32004.
What is the severity of CVE-2023-32004?
The severity of CVE-2023-32004 is high, with a CVSS score of 8.8.
Which software versions are affected by CVE-2023-32004?
CVE-2023-32004 affects Node.js version 20.0.0 to 20.5.0.
What is the CWE ID for CVE-2023-32004?
The CWE ID for CVE-2023-32004 is CWE-22.
How can I fix the vulnerability CVE-2023-32004?
To fix CVE-2023-32004, it is recommended to update Node.js to a version beyond 20.5.0.
- collector/nvd-api
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/20.0.0
- version/nodejs node.js/20.5.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- version/fedoraproject fedora/38
- vendor/ibm
- canonical/ibm planning analytics
- version/ibm planning analytics/2.0