CVE-2024-21890

Katalog CVE

CVSS 6.5 · Medium EPSS 0,95%

Kerentanan pada nodejs node.js. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Rincian

Terbit di NVD

20 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2024/03/11/1 mailing list · advisory pihak ketiga
• https://hackerone.com/reports/2257156 issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240315-0002/ advisory pihak ketiga