An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 07:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html - Mailing List | |
| References | () https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ - Patch, Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20230316-0008/ - | |
| References | () https://www.debian.org/security/2023/dsa-5395 - |
03 May 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Mar 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Mar 2023, 20:06
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.2 |
| CWE | CWE-426 | |
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
|
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html - Mailing List | |
| References | (MISC) https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ - Patch, Vendor Advisory |
26 Feb 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Feb 2023, 22:58
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-23 20:15
Updated : 2025-03-17 19:15
NVD link : CVE-2023-23920
Mitre link : CVE-2023-23920
CVE.ORG link : CVE-2023-23920
JSON object : View
Products Affected
nodejs
- node.js
debian
- debian_linux
CWE
CWE-426
Untrusted Search Path