3.6
CVE-2024-37372
- EPSS 0.05%
- Veröffentlicht 09.01.2025 01:15:08
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle support@hackerone.com
- CVE-Watchlists
- Unerledigt
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerNodeJS
≫
Produkt
Node
Default Statusunaffected
Version
4.0
Version <
4.*
Status
affected
Version
5.0
Version <
5.*
Status
affected
Version
6.0
Version <
6.*
Status
affected
Version
7.0
Version <
7.*
Status
affected
Version
8.0
Version <
8.*
Status
affected
Version
9.0
Version <
9.*
Status
affected
Version
10.0
Version <
10.*
Status
affected
Version
11.0
Version <
11.*
Status
affected
Version
12.0
Version <
12.*
Status
affected
Version
13.0
Version <
13.*
Status
affected
Version
14.0
Version <
14.*
Status
affected
Version
15.0
Version <
15.*
Status
affected
Version
16.0
Version <
16.*
Status
affected
Version
17.0
Version <
17.*
Status
affected
Version
19.0
Version <
19.*
Status
affected
Version
20.0
Version <
20.15.1
Status
affected
Version
21.0
Version <
21.*
Status
affected
Version
22.0
Version <
22.4.1
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.151 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| support@hackerone.com | 3.6 | 1 | 2.5 |
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.