CVE-2023-39331

    Dashboard / Vulnerabilities / CVE-2023-39331

    CVE-2023-39331

    Published: 18 Oct 2023Last Modified: 28 Oct 2026

    Summary:

    Details: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    References: https://hackerone.com/reports/2092852, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39331.json, https://nvd.nist.gov/vuln/detail/CVE-2023-39331, https://security.netapp.com/advisory/ntap-20231116-0009/, https://security.netapp.com/advisory/ntap-20241108-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e7618fb5a5fc25d76b6474e2a6607f04fd6f10e0
    Fixed -b485ffc458edc7140d43093cd8837a7c1ccc5ab3

    Affected versions

    v20.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39331 | CVE-DB