Lucene search

HackeroneCVE-2023-38552

HistoryOct 18, 2023 - 4:15 a.m.

CVE-2023-38552

2023-10-1804:15:11

CWE-345

hackerone

web.nvd.nist.gov

376

node.js

cve-2023-38552

vulnerability

integrity check

security

experimental policy mechanism

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.007

Percentile

80.3%

JSON

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node’s policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Affected configurations

Nvd

Vulners

Node

nodejsnode.jsRange18.0.0–18.18.1

nodejsnode.jsRange20.1.0–20.8.0

Node

fedoraprojectfedoraMatch37

fedoraprojectfedoraMatch38

fedoraprojectfedoraMatch39

VendorProductVersionCPE
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraprojectfedora38cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
fedoraprojectfedora39cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodejs	node.js	*	cpe:2.3:a:nodejs:node.js::::::::
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*
fedoraproject	fedora	38	cpe:2.3:o:fedoraproject:fedora:38:::::::*
fedoraproject	fedora	39	cpe:2.3:o:fedoraproject:fedora:39:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Node.js",
    "product": "Node.js",
    "versions": [
      {
        "version": "20.8.0",
        "status": "affected",
        "lessThanOrEqual": "20.8.0",
        "versionType": "semver"
      },
      {
        "version": "18.18.1",
        "status": "affected",
        "lessThanOrEqual": "18.18.1",
        "versionType": "semver"
      }
    ]
  }
]