MEDIUM 6.5 Microsoft
CVE-2024-22020
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Microsoft Security Update 2024-Jul: A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Affected Products
- cbl2 nodejs18 18.20.3-3 on CBL Mariner 2.0
- azl3 nodejs 20.14.0-5 on Azure Linux 3.0
- azl3 nodejs 20.14.0-8 on Azure Linux 3.0
- cbl2 nodejs18 18.20.3-5 on CBL Mariner 2.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-22020
- https://nvd.nist.gov/vuln/detail/CVE-2024-22020
This medium severity vulnerability with a CVSS score of 6.5 was published on 2024-07-09 via Microsoft. Affected: cbl2 nodejs18 18.20.3-3 on CBL Mariner 2.0, azl3 nodejs 20.14.0-5 on Azure Linux 3.0, azl3 nodejs 20.14.0-8 on Azure Linux 3.0 and 1 more.
vulnfeed aggregates 10103 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.