CVE-2023-30584: Path Traversal
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass when verifying file permissions. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30584?
CVE-2023-30584 has been classified with a moderate severity due to its potential impact on file permission verification.
How do I fix CVE-2023-30584?
To address CVE-2023-30584, it is recommended to upgrade to a later version of Node.js that resolves the experimental permission model flaw.
What software is affected by CVE-2023-30584?
CVE-2023-30584 specifically affects Node.js version 20 and could impact applications dependent on this version.
What type of vulnerability is CVE-2023-30584?
CVE-2023-30584 is a path traversal vulnerability that occurs due to improper handling of file permissions.
Is the permission model in Node.js stable with CVE-2023-30584?
At the time of this CVE, the permission model in Node.js is experimental, which contributes to the vulnerability concerns.