CVE-2022-21704

Katalog CVE

CVSS 5.5 · Medium EPSS 0,30%

Kerentanan Incorrect Default Permissions pada log4js project log4js, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.

Rincian

Terbit di NVD

19 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76 patch · advisory pihak ketiga
• https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q patch · advisory pihak ketiga
• https://github.com/log4js-node/streamroller/pull/87 issue tracking · patch · advisory pihak ketiga
• https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00014.html mailing list · advisory pihak ketiga