BIT-node-min-2024-36138

vendorUSosv

view advisory published 2024-12-16Licence: per source

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-36138US	—	1.10% (65th)	—	2024-09-07
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync…

references

External citations — patches, advisories, analysis.

https://nodejs.org/en/blog/vulnerability/july-2024-security-releasesWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-36138WEB
https://security.netapp.com/advisory/ntap-20241108-0010/WEB
https://www.oracle.com/security-alerts/cpuoct2024.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan