CVE-2023-23920 - Vulnerability Details

Vendors	Products
Debian	Debian Linux
Nodejs	Node.js
Redhat	Enterprise Linux Rhel Eus Rhel Software Collections

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
nodejs:16-8070020230314140722.bd1311ed	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:1582	2023-04-04T00:00:00Z
nodejs:18-8070020230322080930.bd1311ed	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:1583	2023-04-04T00:00:00Z
nodejs:14-8070020230306170042.bd1311ed	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:1743	2023-04-12T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
nodejs:14-8040020230306170312.522a0ee4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2023:1533	2023-03-30T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
nodejs:14-8060020230306170237.ad008a3a	cpe:/a:redhat:rhel_eus:8.6	RHSA-2023:1742	2023-04-12T00:00:00Z
Red Hat Enterprise Linux 9
nodejs:18-9020020230327152102.rhel9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2654	2023-05-09T00:00:00Z
nodejs-1:16.19.1-1.el9_2	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2655	2023-05-09T00:00:00Z
Red Hat Enterprise Linux 9.0 Extended Update Support
nodejs-1:16.20.2-1.el9_0	cpe:/a:redhat:rhel_eus:9.0	RHSA-2023:5533	2023-10-09T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-nodejs14-0:3.6-2.el7	cpe:/a:redhat:rhel_software_collections:3::el7	RHSA-2023:1744	2023-04-12T00:00:00Z
rh-nodejs14-nodejs-0:14.21.3-2.el7	cpe:/a:redhat:rhel_software_collections:3::el7	RHSA-2023:1744	2023-04-12T00:00:00Z

Link	Providers
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
https://nvd.nist.gov/vuln/detail/CVE-2023-23920
https://security.netapp.com/advisory/ntap-20230316-0008/
https://www.cve.org/CVERecord?id=CVE-2023-23920
https://www.debian.org/security/2023/dsa-5395

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00088}`	epss `{'score': 0.0009}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-23920", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "dateUpdated": "2025-04-30T05:57:24.758Z", "dateReserved": "2023-01-19T00:00:00.000Z", "datePublished": "2023-02-23T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T05:57:24.758Z"}, "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges."}], "affected": [{"product": "Node", "vendor": "NodeJS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "4.0", "status": "affected", "lessThan": "4.*"}, {"versionType": "semver", "version": "5.0", "status": "affected", "lessThan": "5.*"}, {"versionType": "semver", "version": "6.0", "status": "affected", "lessThan": "6.*"}, {"versionType": "semver", "version": "7.0", "status": "affected", "lessThan": "7.*"}, {"versionType": "semver", "version": "8.0", "status": "affected", "lessThan": "8.*"}, {"versionType": "semver", "version": "9.0", "status": "affected", "lessThan": "9.*"}, {"versionType": "semver", "version": "10.0", "status": "affected", "lessThan": "10.*"}, {"versionType": "semver", "version": "11.0", "status": "affected", "lessThan": "11.*"}, {"versionType": "semver", "version": "12.0", "status": "affected", "lessThan": "12.*"}, {"versionType": "semver", "version": "13.0", "status": "affected", "lessThan": "13.*"}, {"versionType": "semver", "version": "14.0", "status": "affected", "lessThan": "14.21.3"}, {"versionType": "semver", "version": "15.0", "status": "affected", "lessThan": "15.*"}, {"versionType": "semver", "version": "16.0", "status": "affected", "lessThan": "16.19.1"}, {"versionType": "semver", "version": "17.0", "status": "affected", "lessThan": "17.*"}, {"versionType": "semver", "version": "18.0", "status": "affected", "lessThan": "18.14.1"}, {"versionType": "semver", "version": "19.0", "status": "affected", "lessThan": "19.6.1"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/"}, {"name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"}, {"url": "https://security.netapp.com/advisory/ntap-20230316-0008/"}, {"name": "DSA-5395", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2023/dsa-5395"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "Untrusted Search Path (CWE-426)", "cweId": "CWE-426"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:27.156Z"}, "title": "CVE Program Container", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"}, {"url": "https://security.netapp.com/advisory/ntap-20230316-0008/", "tags": ["x_transferred"]}, {"name": "DSA-5395", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.debian.org/security/2023/dsa-5395"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-426", "lang": "en", "description": "CWE-426 Untrusted Search Path"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-12T14:22:16.608723Z", "id": "CVE-2023-23920", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T18:31:29.432Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2023-23920 (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

assignerShortName : hackerone (string)

dateUpdated : 2025-04-30T05:57:24.758Z (string)

dateReserved : 2023-01-19T00:00:00.000Z (string)

datePublished : 2023-02-23T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2025-04-30T05:57:24.758Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. (string)

}

]

affected : [ »

0 : { »

product : Node (string)

vendor : NodeJS (string)

defaultStatus : unaffected (string)

versions : [ »

0 : { »

versionType : semver (string)

version : 4.0 (string)

status : affected (string)

lessThan : 4.* (string)

}

1 : { »

versionType : semver (string)

version : 5.0 (string)

status : affected (string)

lessThan : 5.* (string)

}

2 : { »

versionType : semver (string)

version : 6.0 (string)

status : affected (string)

lessThan : 6.* (string)

}

3 : { »

versionType : semver (string)

version : 7.0 (string)

status : affected (string)

lessThan : 7.* (string)

}

4 : { »

versionType : semver (string)

version : 8.0 (string)

status : affected (string)

lessThan : 8.* (string)

}

5 : { »

versionType : semver (string)

version : 9.0 (string)

status : affected (string)

lessThan : 9.* (string)

}

6 : { »

versionType : semver (string)

version : 10.0 (string)

status : affected (string)

lessThan : 10.* (string)

}

7 : { »

versionType : semver (string)

version : 11.0 (string)

status : affected (string)

lessThan : 11.* (string)

}

8 : { »

versionType : semver (string)

version : 12.0 (string)

status : affected (string)

lessThan : 12.* (string)

}

9 : { »

versionType : semver (string)

version : 13.0 (string)

status : affected (string)

lessThan : 13.* (string)

}

10 : { »

versionType : semver (string)

version : 14.0 (string)

status : affected (string)

lessThan : 14.21.3 (string)

}

11 : { »

versionType : semver (string)

version : 15.0 (string)

status : affected (string)

lessThan : 15.* (string)

}

12 : { »

versionType : semver (string)

version : 16.0 (string)

status : affected (string)

lessThan : 16.19.1 (string)

}

13 : { »

versionType : semver (string)

version : 17.0 (string)

status : affected (string)

lessThan : 17.* (string)

}

14 : { »

versionType : semver (string)

version : 18.0 (string)

status : affected (string)

lessThan : 18.14.1 (string)

}

15 : { »

versionType : semver (string)

version : 19.0 (string)

status : affected (string)

lessThan : 19.6.1 (string)

}

]

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

}

1 : { »

name : [debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update (string)

tags : [ »

0 : mailing-list (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

}

3 : { »

name : DSA-5395 (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://www.debian.org/security/2023/dsa-5395 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : Untrusted Search Path (CWE-426) (string)

cweId : CWE-426 (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:42:27.156Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

name : [debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

name : DSA-5395 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://www.debian.org/security/2023/dsa-5395 (string)

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-426 (string)

lang : en (string)

description : CWE-426 Untrusted Search Path (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.2 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-12T14:22:16.608723Z (string)

id : CVE-2023-23920 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-17T18:31:29.432Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html", "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230316-0008/", "tags": ["x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5395", "name": "DSA-5395", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:27.156Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-23920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-12T14:22:16.608723Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:22:53.369Z"}}], "cna": {"affected": [{"vendor": "NodeJS", "product": "Node", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.*", "versionType": "semver"}, {"status": "affected", "version": "5.0", "lessThan": "5.*", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.*", "versionType": "semver"}, {"status": "affected", "version": "7.0", "lessThan": "7.*", "versionType": "semver"}, {"status": "affected", "version": "8.0", "lessThan": "8.*", "versionType": "semver"}, {"status": "affected", "version": "9.0", "lessThan": "9.*", "versionType": "semver"}, {"status": "affected", "version": "10.0", "lessThan": "10.*", "versionType": "semver"}, {"status": "affected", "version": "11.0", "lessThan": "11.*", "versionType": "semver"}, {"status": "affected", "version": "12.0", "lessThan": "12.*", "versionType": "semver"}, {"status": "affected", "version": "13.0", "lessThan": "13.*", "versionType": "semver"}, {"status": "affected", "version": "14.0", "lessThan": "14.21.3", "versionType": "semver"}, {"status": "affected", "version": "15.0", "lessThan": "15.*", "versionType": "semver"}, {"status": "affected", "version": "16.0", "lessThan": "16.19.1", "versionType": "semver"}, {"status": "affected", "version": "17.0", "lessThan": "17.*", "versionType": "semver"}, {"status": "affected", "version": "18.0", "lessThan": "18.14.1", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html", "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update", "tags": ["mailing-list"]}, {"url": "https://security.netapp.com/advisory/ntap-20230316-0008/"}, {"url": "https://www.debian.org/security/2023/dsa-5395", "name": "DSA-5395", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "Untrusted Search Path (CWE-426)"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T05:57:24.758Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23920", "state": "PUBLISHED", "dateUpdated": "2025-04-30T05:57:24.758Z", "dateReserved": "2023-01-19T00:00:00.000Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2023-02-23T00:00:00.000Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

name : [debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_transferred (string)

]

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.debian.org/security/2023/dsa-5395 (string)

name : DSA-5395 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:42:27.156Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.2 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-23920 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-12T14:22:16.608723Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-426 (string)

description : CWE-426 Untrusted Search Path (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-12T14:22:53.369Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : NodeJS (string)

product : Node (string)

versions : [ »

0 : { »

status : affected (string)

version : 4.0 (string)

lessThan : 4.* (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 5.0 (string)

lessThan : 5.* (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 6.0 (string)

lessThan : 6.* (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 7.0 (string)

lessThan : 7.* (string)

versionType : semver (string)

}

4 : { »

status : affected (string)

version : 8.0 (string)

lessThan : 8.* (string)

versionType : semver (string)

}

5 : { »

status : affected (string)

version : 9.0 (string)

lessThan : 9.* (string)

versionType : semver (string)

}

6 : { »

status : affected (string)

version : 10.0 (string)

lessThan : 10.* (string)

versionType : semver (string)

}

7 : { »

status : affected (string)

version : 11.0 (string)

lessThan : 11.* (string)

versionType : semver (string)

}

8 : { »

status : affected (string)

version : 12.0 (string)

lessThan : 12.* (string)

versionType : semver (string)

}

9 : { »

status : affected (string)

version : 13.0 (string)

lessThan : 13.* (string)

versionType : semver (string)

}

10 : { »

status : affected (string)

version : 14.0 (string)

lessThan : 14.21.3 (string)

versionType : semver (string)

}

11 : { »

status : affected (string)

version : 15.0 (string)

lessThan : 15.* (string)

versionType : semver (string)

}

12 : { »

status : affected (string)

version : 16.0 (string)

lessThan : 16.19.1 (string)

versionType : semver (string)

}

13 : { »

status : affected (string)

version : 17.0 (string)

lessThan : 17.* (string)

versionType : semver (string)

}

14 : { »

status : affected (string)

version : 18.0 (string)

lessThan : 18.14.1 (string)

versionType : semver (string)

}

15 : { »

status : affected (string)

version : 19.0 (string)

lessThan : 19.6.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

name : [debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update (string)

tags : [ »

0 : mailing-list (string)

]

}

2 : { »

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

}

3 : { »

url : https://www.debian.org/security/2023/dsa-5395 (string)

name : DSA-5395 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-426 (string)

description : Untrusted Search Path (CWE-426) (string)

}

]

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2025-04-30T05:57:24.758Z (string)

}

cveMetadata : { »

cveId : CVE-2023-23920 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-30T05:57:24.758Z (string)

dateReserved : 2023-01-19T00:00:00.000Z (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

datePublished : 2023-02-23T00:00:00.000Z (string)

assignerShortName : hackerone (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482", "versionEndIncluding": "14.14.0", "versionStartIncluding": "14.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "DA48F3CE-68BC-43F1-9428-A9F928420081", "versionEndExcluding": "14.21.3", "versionStartIncluding": "14.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA", "versionEndIncluding": "16.12.0", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "6E9FAEC6-2D3A-4CBE-859F-11BCECC4F724", "versionEndExcluding": "16.19.1", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "33DB62F6-9D8D-42F8-A75E-82DA091C02BC", "versionEndIncluding": "18.11.0", "versionStartIncluding": "18.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "80500AD0-17C2-4698-AE03-1C6782FD38B0", "versionEndExcluding": "18.14.1", "versionStartIncluding": "18.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "8F4FCD16-4B9F-44B9-80DD-D024759CAB10", "versionEndExcluding": "19.6.1", "versionStartIncluding": "19.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges."}], "id": "CVE-2023-23920", "lastModified": "2025-03-17T19:15:19.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-02-23T20:15:14.047", "references": [{"source": "support@hackerone.com", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"}, {"source": "support@hackerone.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/"}, {"source": "support@hackerone.com", "url": "https://security.netapp.com/advisory/ntap-20230316-0008/"}, {"source": "support@hackerone.com", "url": "https://www.debian.org/security/2023/dsa-5395"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20230316-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2023/dsa-5395"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "support@hackerone.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-426"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-426"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 428DCD7B-6F66-4F18-B780-5BD80143D482 (string)

versionEndIncluding : 14.14.0 (string)

versionStartIncluding : 14.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* (string)

matchCriteriaId : DA48F3CE-68BC-43F1-9428-A9F928420081 (string)

versionEndExcluding : 14.21.3 (string)

versionStartIncluding : 14.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA (string)

versionEndIncluding : 16.12.0 (string)

versionStartIncluding : 16.0.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* (string)

matchCriteriaId : 6E9FAEC6-2D3A-4CBE-859F-11BCECC4F724 (string)

versionEndExcluding : 16.19.1 (string)

versionStartIncluding : 16.0.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 33DB62F6-9D8D-42F8-A75E-82DA091C02BC (string)

versionEndIncluding : 18.11.0 (string)

versionStartIncluding : 18.0.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* (string)

matchCriteriaId : 80500AD0-17C2-4698-AE03-1C6782FD38B0 (string)

versionEndExcluding : 18.14.1 (string)

versionStartIncluding : 18.0.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 8F4FCD16-4B9F-44B9-80DD-D024759CAB10 (string)

versionEndExcluding : 19.6.1 (string)

versionStartIncluding : 19.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 07B237A9-69A3-4A9C-9DA0-4E06BD37AE73 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. (string)

}

]

id : CVE-2023-23920 (string)

lastModified : 2025-03-17T19:15:19.303 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.6 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.2 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.6 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-02-23T20:15:14.047 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Mailing List (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

}

1 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

}

2 : { »

source : support@hackerone.com (string)

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

}

3 : { »

source : support@hackerone.com (string)

url : https://www.debian.org/security/2023/dsa-5395 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

]

url : https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://security.netapp.com/advisory/ntap-20230316-0008/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://www.debian.org/security/2023/dsa-5395 (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-426 (string)

}

]

source : support@hackerone.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-426 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

2 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-426 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2023:1582", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:16-8070020230314140722.bd1311ed", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-04-04T00:00:00Z"}, {"advisory": "RHSA-2023:1583", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:18-8070020230322080930.bd1311ed", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-04-04T00:00:00Z"}, {"advisory": "RHSA-2023:1743", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:14-8070020230306170042.bd1311ed", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-04-12T00:00:00Z"}, {"advisory": "RHSA-2023:1533", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "nodejs:14-8040020230306170312.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2023-03-30T00:00:00Z"}, {"advisory": "RHSA-2023:1742", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "nodejs:14-8060020230306170237.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-04-12T00:00:00Z"}, {"advisory": "RHSA-2023:2654", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:18-9020020230327152102.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}, {"advisory": "RHSA-2023:2655", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs-1:16.19.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}, {"advisory": "RHSA-2023:5533", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "nodejs-1:16.20.2-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-10-09T00:00:00Z"}, {"advisory": "RHSA-2023:1744", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs14-0:3.6-2.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2023-04-12T00:00:00Z"}, {"advisory": "RHSA-2023:1744", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs14-nodejs-0:14.21.3-2.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2023-04-12T00:00:00Z"}], "bugzilla": {"description": "Node.js: insecure loading of ICU data through ICU_DATA environment variable", "id": "2172217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172217"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-426", "details": ["An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges."], "name": "CVE-2023-23920", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Fix deferred", "package_name": "3scale-amp-system-container", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2023-02-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-23920\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-23920"], "threat_severity": "Low"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2023:1582 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : nodejs:16-8070020230314140722.bd1311ed (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-04-04T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2023:1583 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : nodejs:18-8070020230322080930.bd1311ed (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-04-04T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2023:1743 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : nodejs:14-8070020230306170042.bd1311ed (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-04-12T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2023:1533 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : nodejs:14-8040020230306170312.522a0ee4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2023-03-30T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2023:1742 (string)

cpe : cpe:/a:redhat:rhel_eus:8.6 (string)

package : nodejs:14-8060020230306170237.ad008a3a (string)

product_name : Red Hat Enterprise Linux 8.6 Extended Update Support (string)

release_date : 2023-04-12T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2023:2654 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : nodejs:18-9020020230327152102.rhel9 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2023-05-09T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2023:2655 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : nodejs-1:16.19.1-1.el9_2 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2023-05-09T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2023:5533 (string)

cpe : cpe:/a:redhat:rhel_eus:9.0 (string)

package : nodejs-1:16.20.2-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9.0 Extended Update Support (string)

release_date : 2023-10-09T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2023:1744 (string)

cpe : cpe:/a:redhat:rhel_software_collections:3::el7 (string)

package : rh-nodejs14-0:3.6-2.el7 (string)

product_name : Red Hat Software Collections for Red Hat Enterprise Linux 7 (string)

release_date : 2023-04-12T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2023:1744 (string)

cpe : cpe:/a:redhat:rhel_software_collections:3::el7 (string)

package : rh-nodejs14-nodejs-0:14.21.3-2.el7 (string)

product_name : Red Hat Software Collections for Red Hat Enterprise Linux 7 (string)

release_date : 2023-04-12T00:00:00Z (string)

}

]

bugzilla : { »

description : Node.js: insecure loading of ICU data through ICU_DATA environment variable (string)

id : 2172217 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2172217 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 4.2 (string)

cvss3_scoring_vector : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N (string)

status : verified (string)

}

cwe : CWE-426 (string)

details : [ »

0 : An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. (string)

]

name : CVE-2023-23920 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:red_hat_3scale_amp:2 (string)

fix_state : Fix deferred (string)

package_name : 3scale-amp-system-container (string)

product_name : Red Hat 3scale API Management Platform 2 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : nodejs (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

]

public_date : 2023-02-16T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-23920 https://nvd.nist.gov/vuln/detail/CVE-2023-23920 (string)

]

threat_severity : Low (string)

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object