BIT-node-2023-23920

2024-03-0611:02:02

Google

osv.dev

node.js

vulnerability

search path

icu data

elevated privileges

software

4.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

4.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.1%

JSON

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

CPENameOperatorVersion
nodege16.0.0
nodege14.0.0
nodelt18.11.0
nodege19.0.0
nodelt16.19.1
nodege18.0.0
nodelt14.14.0
nodelt19.6.1
nodelt16.12.0
nodelt14.21.3