CVE-2023-39331
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises becaus...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Paquets affectés
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]
Références
- advisory hackerone.com
- advisory security.netapp.com
- web nvd.nist.gov
- web security.netapp.com