3.6
CVE-2024-37372
- EPSS 0.05%
- Published 09.01.2025 01:15:08
- Last modified 02.05.2025 23:15:15
- Source support@hackerone.com
- Teams watchlist Login
- Open Login
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorNodeJS
≫
Product
Node
Default Statusunaffected
Version <
4.*
Version
4.0
Status
affected
Version <
5.*
Version
5.0
Status
affected
Version <
6.*
Version
6.0
Status
affected
Version <
7.*
Version
7.0
Status
affected
Version <
8.*
Version
8.0
Status
affected
Version <
9.*
Version
9.0
Status
affected
Version <
10.*
Version
10.0
Status
affected
Version <
11.*
Version
11.0
Status
affected
Version <
12.*
Version
12.0
Status
affected
Version <
13.*
Version
13.0
Status
affected
Version <
14.*
Version
14.0
Status
affected
Version <
15.*
Version
15.0
Status
affected
Version <
16.*
Version
16.0
Status
affected
Version <
17.*
Version
17.0
Status
affected
Version <
19.*
Version
19.0
Status
affected
Version <
20.15.1
Version
20.0
Status
affected
Version <
21.*
Version
21.0
Status
affected
Version <
22.4.1
Version
22.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.15 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| support@hackerone.com | 3.6 | 1 | 2.5 |
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.