CVE-2023-30584 - Vulnerability Details

Vendors	Products
Nodejs	Nodejs

Link	Providers
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
https://nvd.nist.gov/vuln/detail/CVE-2023-30584
https://security.netapp.com/advisory/ntap-20241108-0005/
https://www.cve.org/CVERecord?id=CVE-2023-30584

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241108-0005/

Type	Values Removed	Values Added
First Time appeared		Nodejs Nodejs nodejs
CPEs		cpe:2.3:a:nodejs:nodejs::::::::
Vendors & Products		Nodejs Nodejs nodejs
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Type	Values Removed	Values Added
Description	A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js	A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
References		https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-30584", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2023-04-13T01:00:12.085Z", "datePublished": "2024-09-07T16:00:35.915Z", "dateUpdated": "2025-04-30T22:24:52.470Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js."}], "affected": [{"product": "Node", "vendor": "NodeJS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "4.0", "status": "affected", "lessThan": "4.*"}, {"versionType": "semver", "version": "5.0", "status": "affected", "lessThan": "5.*"}, {"versionType": "semver", "version": "6.0", "status": "affected", "lessThan": "6.*"}, {"versionType": "semver", "version": "7.0", "status": "affected", "lessThan": "7.*"}, {"versionType": "semver", "version": "8.0", "status": "affected", "lessThan": "8.*"}, {"versionType": "semver", "version": "9.0", "status": "affected", "lessThan": "9.*"}, {"versionType": "semver", "version": "10.0", "status": "affected", "lessThan": "10.*"}, {"versionType": "semver", "version": "11.0", "status": "affected", "lessThan": "11.*"}, {"versionType": "semver", "version": "12.0", "status": "affected", "lessThan": "12.*"}, {"versionType": "semver", "version": "13.0", "status": "affected", "lessThan": "13.*"}, {"versionType": "semver", "version": "14.0", "status": "affected", "lessThan": "14.*"}, {"versionType": "semver", "version": "15.0", "status": "affected", "lessThan": "15.*"}, {"versionType": "semver", "version": "17.0", "status": "affected", "lessThan": "17.*"}, {"versionType": "semver", "version": "19.0", "status": "affected", "lessThan": "19.*"}, {"versionType": "semver", "version": "20.0", "status": "affected", "lessThan": "20.3.1"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T22:24:52.470Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "affected": [{"vendor": "nodejs", "product": "nodejs", "cpes": ["cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "20.0", "status": "affected", "lessThan": "20.3.1", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-09T18:33:59.599744Z", "id": "CVE-2023-30584", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T18:35:30.116Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241108-0005/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-08T15:02:45.393Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-30584 (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

state : PUBLISHED (string)

assignerShortName : hackerone (string)

dateReserved : 2023-04-13T01:00:12.085Z (string)

datePublished : 2024-09-07T16:00:35.915Z (string)

dateUpdated : 2025-04-30T22:24:52.470Z (string)

}

containers : { »

cna : { »

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. (string)

}

]

affected : [ »

0 : { »

product : Node (string)

vendor : NodeJS (string)

defaultStatus : unaffected (string)

versions : [ »

0 : { »

versionType : semver (string)

version : 4.0 (string)

status : affected (string)

lessThan : 4.* (string)

}

1 : { »

versionType : semver (string)

version : 5.0 (string)

status : affected (string)

lessThan : 5.* (string)

}

2 : { »

versionType : semver (string)

version : 6.0 (string)

status : affected (string)

lessThan : 6.* (string)

}

3 : { »

versionType : semver (string)

version : 7.0 (string)

status : affected (string)

lessThan : 7.* (string)

}

4 : { »

versionType : semver (string)

version : 8.0 (string)

status : affected (string)

lessThan : 8.* (string)

}

5 : { »

versionType : semver (string)

version : 9.0 (string)

status : affected (string)

lessThan : 9.* (string)

}

6 : { »

versionType : semver (string)

version : 10.0 (string)

status : affected (string)

lessThan : 10.* (string)

}

7 : { »

versionType : semver (string)

version : 11.0 (string)

status : affected (string)

lessThan : 11.* (string)

}

8 : { »

versionType : semver (string)

version : 12.0 (string)

status : affected (string)

lessThan : 12.* (string)

}

9 : { »

versionType : semver (string)

version : 13.0 (string)

status : affected (string)

lessThan : 13.* (string)

}

10 : { »

versionType : semver (string)

version : 14.0 (string)

status : affected (string)

lessThan : 14.* (string)

}

11 : { »

versionType : semver (string)

version : 15.0 (string)

status : affected (string)

lessThan : 15.* (string)

}

12 : { »

versionType : semver (string)

version : 17.0 (string)

status : affected (string)

lessThan : 17.* (string)

}

13 : { »

versionType : semver (string)

version : 19.0 (string)

status : affected (string)

lessThan : 19.* (string)

}

14 : { »

versionType : semver (string)

version : 20.0 (string)

status : affected (string)

lessThan : 20.3.1 (string)

}

]

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2025-04-30T22:24:52.470Z (string)

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-22 (string)

lang : en (string)

description : CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (string)

}

]

}

]

affected : [ »

0 : { »

vendor : nodejs (string)

product : nodejs (string)

cpes : [ »

0 : cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 20.0 (string)

status : affected (string)

lessThan : 20.3.1 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.7 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-09T18:33:59.599744Z (string)

id : CVE-2023-30584 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-09T18:35:30.116Z (string)

}

1 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://security.netapp.com/advisory/ntap-20241108-0005/ (string)

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-11-08T15:02:45.393Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241108-0005/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-08T15:02:45.393Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-30584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-09T18:33:59.599744Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"], "vendor": "nodejs", "product": "nodejs", "versions": [{"status": "affected", "version": "20.0", "lessThan": "20.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T18:34:27.339Z"}}], "cna": {"affected": [{"vendor": "Node.js", "product": "Node.js", "versions": [{"status": "affected", "version": "20.3.1", "lessThan": "20.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-09-07T16:00:35.915Z"}}}, "cveMetadata": {"cveId": "CVE-2023-30584", "state": "PUBLISHED", "dateUpdated": "2024-11-08T15:02:45.393Z", "dateReserved": "2023-04-13T01:00:12.085Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2024-09-07T16:00:35.915Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://security.netapp.com/advisory/ntap-20241108-0005/ (string)

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-11-08T15:02:45.393Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.7 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-30584 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-09T18:33:59.599744Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:* (string)

]

vendor : nodejs (string)

product : nodejs (string)

versions : [ »

0 : { »

status : affected (string)

version : 20.0 (string)

lessThan : 20.3.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-22 (string)

description : CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-09T18:34:27.339Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Node.js (string)

product : Node.js (string)

versions : [ »

0 : { »

status : affected (string)

version : 20.3.1 (string)

lessThan : 20.3.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2024-09-07T16:00:35.915Z (string)

}

cveMetadata : { »

cveId : CVE-2023-30584 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-08T15:02:45.393Z (string)

dateReserved : 2023-04-13T01:00:12.085Z (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

datePublished : 2024-09-07T16:00:35.915Z (string)

assignerShortName : hackerone (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"descriptions": [{"lang": "en", "value": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en la versi\u00f3n 20 de Node.js, espec\u00edficamente en el modelo de permisos experimental. Esta falla est\u00e1 relacionada con el manejo inadecuado de la omisi\u00f3n de la ruta de acceso al verificar los permisos de los archivos. Tenga en cuenta que, en el momento en que se emiti\u00f3 esta CVE, el modelo de permisos era una caracter\u00edstica experimental de Node.js."}], "id": "CVE-2023-30584", "lastModified": "2024-11-21T08:00:27.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-07T16:15:02.167", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241108-0005/"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. (string)

}

1 : { »

lang : es (string)

value : Se ha descubierto una vulnerabilidad en la versión 20 de Node.js, específicamente en el modelo de permisos experimental. Esta falla está relacionada con el manejo inadecuado de la omisión de la ruta de acceso al verificar los permisos de los archivos. Tenga en cuenta que, en el momento en que se emitió esta CVE, el modelo de permisos era una característica experimental de Node.js. (string)

}

]

id : CVE-2023-30584 (string)

lastModified : 2024-11-21T08:00:27.870 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.5 (number)

impactScore : 5.2 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-09-07T16:15:02.167 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://security.netapp.com/advisory/ntap-20241108-0005/ (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "nodejs: path traversal bypass in experimental permission model", "id": "2219829", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219829"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.\nThis vulnerability affects all users using the experimental permission model in Node.js"], "name": "CVE-2023-30584", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:14/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:16/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs14-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2023-06-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-30584\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-30584"], "statement": "Red Hat does not ship Node.js 20.x in any version of RHEL.", "threat_severity": "Moderate"}

{

bugzilla : { »

description : nodejs: path traversal bypass in experimental permission model (string)

id : 2219829 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2219829 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

status : draft (string)

}

cwe : CWE-22 (string)

details : [ »

0 : A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. (string)

1 : A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js (string)

]

name : CVE-2023-30584 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)