Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-h9p4-9jqg-j34h

Опубликовано: 15 сент. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

The use of the deprecated API process.binding() can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

The use of the deprecated API process.binding() can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

EPSS

Процентиль: 35%
0.00142
Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 2 года назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
redhat
почти 2 года назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
nvd
почти 2 года назад

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS3: 7.5
debian
почти 2 года назад

The use of the deprecated API `process.binding()` can bypass the permi ...

CVSS3: 7.5
fstec
почти 2 года назад

Уязвимость функции process.binding() программной платформы Node.js, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 35%
0.00142
Низкий

7.5 High

CVSS3

Дефекты

CWE-22