LOW 3.3 Microsoft
CVE-2024-36137
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Microsoft Security Update 2024-Sep: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Affected Products
- azl3 nodejs 20.14.0-15 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-36137
- https://nvd.nist.gov/vuln/detail/CVE-2024-36137
This low severity vulnerability with a CVSS score of 3.3 was published on 2024-09-10 via Microsoft. Affected: azl3 nodejs 20.14.0-15 on Azure Linux 3.0.
vulnfeed aggregates 14962 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.