CVE-2024-22020
First published: Tue Jul 09 2024(Updated: )
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Planning Analytics | <=2.1 | |
| IBM Planning Analytics | <=2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:5815
- https://access.redhat.com/errata/RHSA-2024:5814
- https://access.redhat.com/errata/RHSA-2024:6147
- https://access.redhat.com/errata/RHSA-2024:6148
- https://bugzilla.redhat.com/show_bug.cgi?id=2296417
- https://hackerone.com/reports/2092749
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
- https://security.netapp.com/advisory/ntap-20241122-0006/
- https://www.ibm.com/support/pages/node/7168387 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-22020?
CVE-2024-22020 is considered a high-severity vulnerability due to its potential to allow attackers to execute arbitrary code.
How do I fix CVE-2024-22020?
To fix CVE-2024-22020, ensure data URLs are forbidden in network imports in affected software versions.
Which versions of IBM Planning Analytics are affected by CVE-2024-22020?
CVE-2024-22020 affects IBM Planning Analytics versions up to and including 2.1 and 2.0.
Can CVE-2024-22020 be exploited on all platforms?
Yes, CVE-2024-22020 has been verified to be exploitable on various platforms.
What is the main impact of CVE-2024-22020?
The main impact of CVE-2024-22020 is the compromise of system security through the execution of arbitrary code.
- agent/first-publish-date
- agent/type
- agent/author
- agent/weakness
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-22020
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/trending
- agent/source
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm planning analytics
- version/ibm planning analytics/2.1
- version/ibm planning analytics/2.0