CVE-2017-16024

    Dashboard / Vulnerabilities / CVE-2017-16024

    CVE-2017-16024

    Published: 4 Jun 2018Last Modified: 8 Jul 2026

    Summary:

    Details: The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.

    References: https://cwe.mitre.org/data/definitions/377.html, https://nodesecurity.io/advisories/310, https://www.owasp.org/index.php/Insecure_Temporary_File, https://github.com/gvarsanyi/sync-exec/issues/17

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dcfd032bdd69dfb38c120e18438d6316ae522edc

    Affected versions

    v0.7.3
    v0.7.2
    v0.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-16024 | CVE-DB