CVE-2023-39331

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6

High · published October 18, 2023

CVSS v3.0
7.7
EPSS
2%
Percentile
74.2
In the wild
Unconfirmed
What it is

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

The record
Technical detail
CVSS v3.0
7.7 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01508 · 74.2th percentile
Published
2023-10-18T03:55Z
EPSS history
Timeline
  • 18 OCT 03:55Z
    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
    cvelistv5