CVE-2013-4116

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVSS v2.0 3.3 LOW

3.3^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 3.4 / Impact : 4.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.openwall.com/lists/oss-security/2013/07/10/17	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/07/11/9	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/61083	Third Party Advisory VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325	Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=983917	Issue Tracking Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/87141	Third Party Advisory VDB Entry
https://github.com/npm/npm/commit/f4d31693	Patch Third Party Advisory
https://github.com/npm/npm/issues/3635	Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/07/10/17	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/07/11/9	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/61083	Third Party Advisory VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325	Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=983917	Issue Tracking Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/87141	Third Party Advisory VDB Entry
https://github.com/npm/npm/commit/f4d31693	Patch Third Party Advisory
https://github.com/npm/npm/issues/3635	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 01:54

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2013/07/10/17 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2013/07/10/17 - Mailing List, Third Party Advisory
References	~~() http://www.openwall.com/lists/oss-security/2013/07/11/9 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2013/07/11/9 - Mailing List, Third Party Advisory
References	~~() http://www.securityfocus.com/bid/61083 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/61083 - Third Party Advisory, VDB Entry
References	~~() https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325 - Issue Tracking, Third Party Advisory~~	() https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325 - Issue Tracking, Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=983917 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=983917 - Issue Tracking, Third Party Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/87141 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/87141 - Third Party Advisory, VDB Entry
References	~~() https://github.com/npm/npm/commit/f4d31693 - Patch, Third Party Advisory~~	() https://github.com/npm/npm/commit/f4d31693 - Patch, Third Party Advisory
References	~~() https://github.com/npm/npm/issues/3635 - Third Party Advisory~~	() https://github.com/npm/npm/issues/3635 - Third Party Advisory

Information

Published : 2014-04-22 14:23

Updated : 2024-11-21 01:54

NVD link : CVE-2013-4116

Mitre link : CVE-2013-4116

CVE.ORG link : CVE-2013-4116

JSON object : View

Products Affected

node_packaged_modules_project

node_packaged_modules

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

3.3 /10