CVE-2023-23920
4.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Summary
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NodeJS | Node | 4.0 < 4.* | affected |
| NodeJS | Node | 5.0 < 5.* | affected |
| NodeJS | Node | 6.0 < 6.* | affected |
| NodeJS | Node | 7.0 < 7.* | affected |
| NodeJS | Node | 8.0 < 8.* | affected |
| NodeJS | Node | 9.0 < 9.* | affected |
| NodeJS | Node | 10.0 < 10.* | affected |
| NodeJS | Node | 11.0 < 11.* | affected |
| NodeJS | Node | 12.0 < 12.* | affected |
| NodeJS | Node | 13.0 < 13.* | affected |
| NodeJS | Node | 14.0 < 14.21.3 | affected |
| NodeJS | Node | 15.0 < 15.* | affected |
| NodeJS | Node | 16.0 < 16.19.1 | affected |
| NodeJS | Node | 17.0 < 17.* | affected |
| NodeJS | Node | 18.0 < 18.14.1 | affected |
| NodeJS | Node | 19.0 < 19.6.1 | affected |
Weaknesses
- CWE-426: Untrusted Search Path (CWE-426)
ADP Enrichment
CVE Program Container
Additional References
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
- https://security.netapp.com/advisory/ntap-20230316-0008/
- https://www.debian.org/security/2023/dsa-5395
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
- https://security.netapp.com/advisory/ntap-20230316-0008/
- https://www.debian.org/security/2023/dsa-5395
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.