CVE-2023-30583: High severity ibm planning analytics cloud vulnerability
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by a missing check in the fs.openAsBlob() API. By using the file system read restriction with the --allow-fs-read flag, an attacker could exploit this vulnerability to bypass the experimental permission model.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30583?
CVE-2023-30583 has a moderate severity due to the potential for unauthorized access to file system data.
How do I fix CVE-2023-30583?
To fix CVE-2023-30583, ensure that you are using a version of Node.js that is updated to include the necessary checks in the fs.openAsBlob() API.
Which software is affected by CVE-2023-30583?
CVE-2023-30583 affects IBM Planning Analytics version 2.0 and earlier.
What causes CVE-2023-30583?
CVE-2023-30583 is caused by a missing check in the fs.openAsBlob() API that allows bypassing the file system read restriction.
Is CVE-2023-30583 an issue with Node.js?
Yes, CVE-2023-30583 is a vulnerability within the Node.js environment related to the file system permission model.