Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-h9p4-9jqg-j34h

Опубликовано: 15 сент. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

The use of the deprecated API process.binding() can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

The use of the deprecated API process.binding() can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

EPSS

Процентиль: 30%
0.00107
Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 2 лет назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
redhat
около 2 лет назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
nvd
около 2 лет назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
debian
около 2 лет назад

The use of the deprecated API `process.binding()` can bypass the permi ...

CVSS3: 7.5
fstec
больше 2 лет назад

Уязвимость функции process.binding() программной платформы Node.js, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 30%
0.00107
Низкий

7.5 High

CVSS3

Дефекты

CWE-22