CVE-2024-36137

Katalog CVE

CVSS 3.3 · Low EPSS 0,40%

Skor CVSS 3.0 3.3 (Low) menurut hackerone.com.

Deskripsi (NVD)

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

Rincian

Terbit di NVD

7 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.0

3.3 (Low), sumber hackerone.com
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
• https://security.netapp.com/advisory/ntap-20241122-0005/