BIT-node-2023-30583

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/node/BIT-node-2023-30583.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-node-2023-30583

Aliases

CVE-2023-30583

Published

2024-09-10T07:19:44.533Z

Modified

2024-09-10T08:12:33.215142Z

Summary

[none]

Details

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

References

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

Affected packages

Bitnami / node

Package

Name: node
Purl: pkg:bitnami/node

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

20.0.0

Fixed

20.3.1