CVE-2024-21891: Path Traversal
Node.js could allow a remote attacker to bypass security restrictions, caused by improper path traversal sequence sanitization. By using a path traversal attack, an attacker could exploit this vulnerability leading to filesystem permission model bypass.
Other sources
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.
Impacts: This vulnerability affects all users using the experimental permission model in active release lines: 20.x and 21.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— Red Hat
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21891?
CVE-2024-21891 is classified as a high severity vulnerability due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2024-21891?
To mitigate CVE-2024-21891, update Node.js to version 20.11.1 or apply the relevant patches for IBM Cognos Analytics.
What types of attacks can exploit CVE-2024-21891?
CVE-2024-21891 can be exploited through path traversal attacks, allowing unauthorized access to files in the system.
Which software is affected by CVE-2024-21891?
CVE-2024-21891 affects Node.js and specific versions of IBM Cognos Analytics.
What is the impact of CVE-2024-21891?
The impact of CVE-2024-21891 includes potential unauthorized access to the filesystem, compromising the security of the application.