CVE-2022-21704

    Dashboard / Vulnerabilities / CVE-2022-21704

    CVE-2022-21704

    Published: 19 Jan 2022Last Modified: 12 Aug 2026

    Summary: Incorrect Default Permissions in log4js-node

    Details: log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.

    References: https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640, https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21704.json, https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q, https://nvd.nist.gov/vuln/detail/CVE-2022-21704, https://github.com/log4js-node/streamroller/pull/87, https://lists.debian.org/debian-lts-announce/2022/12/msg00014.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9fdbed5ad45d1b09b35c1ef5355ba726b60cb702

    Affected versions

    v6.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-21704 | CVE-DB