CVE-2023-38552: High severity ibm cognos analytics vulnerability
Node.js could allow a remote attacker to bypass security restrictions, caused by the circumvention of integrity checks by the policy feature. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.
Other sources
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to node's policy implementation, thus effectively disabling the integrity check.
References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
— Red Hat
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-38552.
What is the severity of CVE-2023-38552?
The severity of CVE-2023-38552 is medium (severity value: 4).
How does CVE-2023-38552 affect Node.js?
CVE-2023-38552 affects all users of Node.js.
What is the impact of CVE-2023-38552?
The impact of CVE-2023-38552 is that the vulnerability allows an application to disable the integrity check of a resource.
Are there any references available for CVE-2023-38552?
Yes, you can find references for CVE-2023-38552 at the following links: [https://hackerone.com/reports/2094235](https://hackerone.com/reports/2094235), [https://nodejs.org/en/blog/vulnerability/october-2023-security-releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases), [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2244472](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2244472).