| ID |
CVE-2024-22017
|
| Sažetak |
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. |
| Reference |
|
| CVSS |
| Base: | 7.3 |
| Impact: | 5.3 |
| Exploitability: | 1.5 |
|
| Pristup |
| Vektor | Složenost | Autentikacija |
| LOCAL |
LOW |
HIGH |
|
| Impact |
| Povjerljivost | Cjelovitost | Dostupnost |
| LOW |
HIGH |
LOW |
|
| CVSS vektor |
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L |
| Zadnje važnije ažuriranje |
15-08-2024 - 19:35 |
| Objavljeno |
19-03-2024 - 05:15 |
