CVE-2023-23918: High severity ibm cognos controller vulnerability
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
Other sources
It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
— Red Hat
Node.js could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when enable the experimental permissions option with --experimental-policy. By sending a specially-crafted request using process.mainModule.require(), an attacker could exploit this vulnerability to bypass Permissions and access non authorized modules.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-23918?
CVE-2023-23918 is a privilege escalation vulnerability in Node.js versions <19.6.1, <18.14.1, <16.19.1, and <14.21.3.
How can this vulnerability be exploited?
This vulnerability allows an attacker to bypass the experimental Permissions feature in Node.js and access unauthorized modules by using process.mainModule.require().
What is the severity level of CVE-2023-23918?
CVE-2023-23918 has a severity level of high.
How can I fix CVE-2023-23918?
To fix CVE-2023-23918, you need to update your Node.js version to 19.6.1 or higher, 18.14.1 or higher, 16.19.1 or higher, or 14.21.3 or higher.
Where can I find more information about CVE-2023-23918?
You can find more information about CVE-2023-23918 on the Red Hat Bugzilla website, using the following links: [link1], [link2], [link3].