CVE-2023-38552

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Oct 18, 2023
Updated: Feb 16, 2024
CWE ID 345

Summary

CVE-2023-38552 is a vulnerability affecting Node.js users on active release lines 18.x and 20.x. The issue arises from the policy feature, which checks the integrity of resources against trusted manifests. A malicious application can intercept this operation and return a forged checksum to the node's policy implementation, effectively disabling the integrity check. This vulnerability poses a significant risk as it can bypass security measures intended to protect against unauthorized modifications. It is important to note that at the time this CVE was issued, the policy mechanism was an experimental feature of Node.js.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Nodejs Node.js
  • Fedora Operating System

Affected Vendors

  • Fedora Project
  • Nodejs