Lucene search

[email protected]NVD:CVE-2022-21704

HistoryJan 19, 2022 - 11:15 p.m.

CVE-2022-21704

2022-01-1923:15:08

CWE-276

[email protected]

web.nvd.nist.gov

log4js-node

file permissions

vulnerability

update

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

17.3%

JSON

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.

Affected configurations

Nvd

Node

log4js_projectlog4jsRange<6.4.0node.js

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
log4js_projectlog4js*cpe:2.3:a:log4js_project:log4js:*:*:*:*:*:node.js:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*