CVE-2023-38552
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-38552 is a vulnerability affecting Node.js users on active release lines 18.x and 20.x. The issue arises from the policy feature, which checks the integrity of resources against trusted manifests. A malicious application can intercept this operation and return a forged checksum to the node's policy implementation, effectively disabling the integrity check. This vulnerability poses a significant risk as it can bypass security measures intended to protect against unauthorized modifications. It is important to note that at the time this CVE was issued, the policy mechanism was an experimental feature of Node.js.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Nodejs Node.js
- Fedora Operating System
Affected Vendors
- Fedora Project
- Nodejs
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions