CVE-2023-39331
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises becaus...
Original description
The description as published by the source.
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected packages
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]
References
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web hackerone.com