Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-36137

Date: September 7, 2024

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

Language: JS

Severity Score

Related Resources (5)

https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
https://security.netapp.com/advisory/ntap-20241122-0005/
https://github.com/nodejs/node/commit/01e9eac91234100bff0151c70caa84c110910081
https://nvd.nist.gov/vuln/detail/CVE-2024-36137
https://www.mend.io/vulnerability-database/CVE-2024-36137

Severity Score

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us