BIT-node-2023-32558

vendorUSosv

view advisory published 2024-03-06Licence: per source

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-32558US	high7.5	1.74% (78th)	—	2023-09-12
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission m…

references

External citations — patches, advisories, analysis.

https://hackerone.com/reports/2051257ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-32558WEB
https://security.netapp.com/advisory/ntap-20241025-0003/WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan