3.3

CVE-2024-36137

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerNodeJS
≫
Produkt Node
Default Statusunaffected
Version 4.0
Version < 4.*
Status affected
Version 5.0
Version < 5.*
Status affected
Version 6.0
Version < 6.*
Status affected
Version 7.0
Version < 7.*
Status affected
Version 8.0
Version < 8.*
Status affected
Version 9.0
Version < 9.*
Status affected
Version 10.0
Version < 10.*
Status affected
Version 11.0
Version < 11.*
Status affected
Version 12.0
Version < 12.*
Status affected
Version 13.0
Version < 13.*
Status affected
Version 14.0
Version < 14.*
Status affected
Version 15.0
Version < 15.*
Status affected
Version 16.0
Version < 16.*
Status affected
Version 17.0
Version < 17.*
Status affected
Version 19.0
Version < 19.*
Status affected
Version 20.0
Version < 20.15.1
Status affected
Version 21.0
Version < 21.*
Status affected
Version 22.0
Version < 22.4.1
Status affected
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.312
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
HackerOne 3.3 1.8 1.4
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
https://security.netapp.com/advisory/ntap-20241122-0005/