CVE-2023-32004: Path Traversal
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.
This vulnerability affects all users using the experimental permission model in Node.js 20.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of Buffers in file system APIs within the experimental permission model. By specifying a path traversal sequence in a Buffer, an attacker could exploit this vulnerability to cause a path traversal bypass when verifying file permissions.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Node.js vulnerability?
The vulnerability ID for this Node.js vulnerability is CVE-2023-32004.
What is the severity of CVE-2023-32004?
The severity of CVE-2023-32004 is high, with a CVSS score of 8.8.
Which software versions are affected by CVE-2023-32004?
CVE-2023-32004 affects Node.js version 20.0.0 to 20.5.0.
What is the CWE ID for CVE-2023-32004?
The CWE ID for CVE-2023-32004 is CWE-22.
How can I fix the vulnerability CVE-2023-32004?
To fix CVE-2023-32004, it is recommended to update Node.js to a version beyond 20.5.0.