The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
References
Link | Resource |
---|---|
https://hackerone.com/reports/1960870 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230915-0009/ |
Configurations
Configuration 1 (hide)
|
History
07 Oct 2024, 19:36
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-288 |
15 Sep 2023, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
24 Aug 2023, 21:09
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://hackerone.com/reports/1960870 - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CWE | NVD-CWE-noinfo | |
CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | |
First Time |
Nodejs node.js
Nodejs |
21 Aug 2023, 18:35
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-08-21 17:15
Updated : 2024-10-07 19:36
NVD link : CVE-2023-32002
Mitre link : CVE-2023-32002
CVE.ORG link : CVE-2023-32002
JSON object : View
Products Affected
nodejs
- node.js
CWE