CVE-2024-37372: Permission model improperly processes UNC paths
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Other sources
The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
This vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.15.1Fixed in 22.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.4.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-37372?
CVE-2024-37372 is considered a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2024-37372?
To fix CVE-2024-37372, users should update IBM Planning Analytics to version 2.1 or later.
What products are affected by CVE-2024-37372?
CVE-2024-37372 affects IBM Planning Analytics versions up to and including 2.1 and 2.0.
What type of attack can exploit CVE-2024-37372?
CVE-2024-37372 can be exploited by attackers through improper processing of UNC paths leading to potential security bypass.
What is the primary cause of CVE-2024-37372?
CVE-2024-37372 is caused by the Permission Model's improper handling of paths that start with two backslashes.