CVE-2023-32558
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-32558 is a cyber vulnerability that affects users of Node.js 20.x who are using the experimental permission model. The vulnerability is caused by the use of the deprecated API `process.binding()`, which can bypass the permission model through path traversal. The potential danger of this vulnerability is rated as high, with a base severity score of 7.5. It has an exploitability score of 3.9 and an impact score of 3.6. The vulnerability does not require any privileges or user interaction, and it can be exploited through a network attack vector. The integrity impact is high, while the confidentiality impact is none. To remediate this vulnerability, users should update their Node.js version to a non-experimental release that addresses this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions