CVE-2025-23083

Katalog CVE

CVSS 7.7 · High EPSS 0,42%

Kerentanan Improper Access Control. Skor CVSS 3.0 7.7 (High) menurut hackerone.com.

Deskripsi (NVD)

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

Rincian

Terbit di NVD

22 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.0

7.7 (High), sumber hackerone.com
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
• https://security.netapp.com/advisory/ntap-20250228-0008/
• https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability