CVE-2023-32558

{
  "id": "CVE-2023-32558",
  "sourceIdentifier": "[email protected]",
  "published": "2023-09-12T02:15:12.067",
  "lastModified": "2026-11-02T23:17:16.480",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js."
    },
    {
      "lang": "es",
      "value": "El uso de la API obsoleta `process.binding()` puede omitir el modelo de permiso a través del Path Traversal. Esta vulnerabilidad afecta a todos los usuarios que utilizan el modelo de permisos experimental en Node.js 20.x. Tenga en cuenta que en el momento en que se emitió este CVE, el modelo de permiso es una característica experimental de Node.js."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NodeJS",
          "product": "Node",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.0",
              "lessThan": "4.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.0",
              "lessThan": "5.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0",
              "lessThan": "6.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.0",
              "lessThan": "7.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.0",
              "lessThan": "8.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.0",
              "lessThan": "9.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "10.0",
              "lessThan": "10.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "11.0",
              "lessThan": "11.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.0",
              "lessThan": "12.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "13.0",
              "lessThan": "13.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.0",
              "lessThan": "14.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.0",
              "lessThan": "15.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "17.0",
              "lessThan": "17.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "19.0",
              "lessThan": "19.*",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "20.0",
              "lessThan": "20.5.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-08T21:07:36.422694Z",
          "id": "CVE-2023-32558",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "20.0.0",
              "versionEndExcluding": "20.5.1",
              "matchCriteriaId": "1B1EE318-9E7D-4AF1-9FB5-245C9F8BBBE0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://hackerone.com/reports/2051257",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://hackerone.com/reports/2051257",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20241025-0003/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}