CVE-2024-37372 The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
LowCVSS 3.6
EPSS 0.49%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux nodejs(Azure Linux:3.0) | All versions | No fix listed |
| nodejs node | >= 4.0 | No fix listed |
| nodejs node | >= 5.0 | No fix listed |
| nodejs node | >= 6.0 | No fix listed |
| nodejs node | >= 7.0 | No fix listed |
| nodejs node | >= 8.0 | No fix listed |
| nodejs node | >= 9.0 | No fix listed |
| nodejs node | >= 10.0 | No fix listed |
| nodejs node | >= 11.0 | No fix listed |
| nodejs node | >= 12.0 | No fix listed |
| nodejs node | >= 13.0 | No fix listed |
| nodejs node | >= 14.0 | No fix listed |
| nodejs node | >= 15.0 | No fix listed |
| nodejs node | >= 16.0 | No fix listed |
| nodejs node | >= 17.0 | No fix listed |
| nodejs node | >= 19.0 | No fix listed |
| nodejs node | >= 20.0, < 20.15.1 | 20.15.1 |
| nodejs node | >= 21.0 | No fix listed |
| nodejs node | >= 22.0, < 22.4.1 | 22.4.1 |
| alpine/nodejs(Alpine:v3.19) | < 0 | No fix listed |
| alpine/nodejs(Alpine:v3.20) | < 0 | No fix listed |
| alpine/nodejs(Alpine:v3.21) | < 0 | No fix listed |
| alpine/nodejs(Alpine:v3.22) | < 0 | No fix listed |
| alpine/nodejs(Alpine:v3.23) | < 0 | No fix listed |
| alpine/nodejs(Alpine:v3.24) | < 0 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- www.openwall.com
- www.openwall.com
- security.netapp.com
- security.alpinelinux.org vendor-advisory
- Debian Security Tracker CVE-2024-37372 vendor-advisory