Description (CNA)
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NodeJS / Node | affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 19.0 before 19.*; affected 20.0 before 20.15.1; affected 21.0 before 21.*; affected 22.0 before 22.4.1 |
CWE
No CWE identifiers supplied.
References
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.