CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32002 – nodejs: Permissions policies can be bypassed via Module._load
https://notcve.org/view.php?id=CVE-2023-32002
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. El uso de 'Module._load()' puede omitir el mecanismo de políticas y requerir módulos fuera de la definición policy.json para un módulo determinado. Esta vulnerabilidad afecta a todos los usuarios que utilizan el mecanismo de directiva experimental en todas las líneas de versión activas: 16.x, 18.x y 20.x. • https://hackerone.com/reports/1960870 https://security.netapp.com/advisory/ntap-20230915-0009 https://access.redhat.com/security/cve/CVE-2023-32002 https://bugzilla.redhat.com/show_bug.cgi?id=2230948 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32003
https://notcve.org/view.php?id=CVE-2023-32003
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. fs.mkdtemp()' y 'fs.mkdtempSync()' se pueden usar para omitir la comprobación del modelo de permisos mediante un ataque Path Traversal. Esta falla surge de una comprobación faltante en la API fs.mkdtemp() y el impacto es que un actor malicioso podría crear un directorio arbitrario. Esta vulnerabilidad afecta a todos los usuarios que usan el modelo de permisos experimental en Node.js 20. Tenga en cuenta que en el momento en que se emitió este CVE, el modelo de permisos es una característica experimental de Node.js. • https://hackerone.com/reports/2037887 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX https://security.netapp.com/advisory/ntap-20230915-0009 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32004
https://notcve.org/view.php?id=CVE-2023-32004
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Se ha descubierto una vulnerabilidad en Node.js versión 20, específicamente dentro del modelo de permisos experimentales. Esta falla se relaciona con el manejo incorrecto de los Búferes en las API del sistema de archivos, lo que hace que se omita un Path Traversal al verificar los permisos de archivo. Esta vulnerabilidad afecta a todos los usuarios que usan el modelo de permisos experimental en Node.js 20. • https://hackerone.com/reports/2038134 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX https://security.netapp.com/advisory/ntap-20230915-0009 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32006 – nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
https://notcve.org/view.php?id=CVE-2023-32006
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. El uso de 'module.constructor.createRequire()' puede omitir el mecanismo de políticas y requerir módulos fuera de la definición policy.json para un módulo determinado. Esta vulnerabilidad afecta a todos los usuarios que usan el mecanismo de directiva experimental en todas las líneas de versión activas: 16.x, 18.x y 20.x. Tenga en cuenta que en el momento en que se emitió este CVE, la política es una característica experimental de Node.js. A vulnerability was found in NodeJS. • https://hackerone.com/reports/2043807 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX https://security.netapp.com/advisory/ntap-20230915-0009 https://access.redhat.com/security/cve/CVE-2023-32006 https://bugzilla.redhat.com/show_bug.cgi?id=2230955 • CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-30581 – nodejs: mainModule.proto bypass experimental policy mechanism
https://notcve.org/view.php?id=CVE-2023-30581
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js El uso de __proto__ en process.mainModule.__proto__.require() puede omitir el mecanismo de políticas y requerir módulos fuera de la definición de policy.json. Esta vulnerabilidad afecta a todos los usuarios que utilizan el mecanismo de política experimental en todas las líneas de lanzamiento activas: v16, v18 y v20. • https://nodejs.org/en/blog/vulnerability/june-2023-security-releases https://access.redhat.com/security/cve/CVE-2023-30581 https://bugzilla.redhat.com/show_bug.cgi?id=2219824 •