mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 01:02:25 +00:00
124 lines
4.1 KiB
JSON
124 lines
4.1 KiB
JSON
{
|
|
"id": "CVE-2023-23918",
|
|
"sourceIdentifier": "support@hackerone.com",
|
|
"published": "2023-02-23T20:15:13.920",
|
|
"lastModified": "2023-03-16T16:15:11.720",
|
|
"vulnStatus": "Modified",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-863"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
|
|
"versionStartIncluding": "14.0.0",
|
|
"versionEndIncluding": "14.14.0",
|
|
"matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
|
|
"versionStartIncluding": "14.0.0",
|
|
"versionEndExcluding": "14.21.3",
|
|
"matchCriteriaId": "DA48F3CE-68BC-43F1-9428-A9F928420081"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
|
|
"versionStartIncluding": "16.0.0",
|
|
"versionEndIncluding": "16.12.0",
|
|
"matchCriteriaId": "1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
|
|
"versionStartIncluding": "16.0.0",
|
|
"versionEndExcluding": "16.19.1",
|
|
"matchCriteriaId": "6E9FAEC6-2D3A-4CBE-859F-11BCECC4F724"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
|
|
"versionStartIncluding": "18.0.0",
|
|
"versionEndIncluding": "18.11.0",
|
|
"matchCriteriaId": "33DB62F6-9D8D-42F8-A75E-82DA091C02BC"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
|
|
"versionStartIncluding": "18.0.0",
|
|
"versionEndExcluding": "18.14.1",
|
|
"matchCriteriaId": "80500AD0-17C2-4698-AE03-1C6782FD38B0"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
|
|
"versionStartIncluding": "19.0.0",
|
|
"versionEndExcluding": "19.6.1",
|
|
"matchCriteriaId": "8F4FCD16-4B9F-44B9-80DD-D024759CAB10"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
|
|
"source": "support@hackerone.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20230316-0008/",
|
|
"source": "support@hackerone.com"
|
|
}
|
|
]
|
|
} |