Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Remediation

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985

https://bugzilla.redhat.com/show_bug.cgi?id=1611614

https://github.com/isaacs/chownr/issues/14

https://snyk.io/vuln/npm:chownr:20180731

Related Vulnerabilities

CVE-2021-21388 Vulnerability in npm package systeminformation

CVE-2020-36649 Vulnerability in maven package org.webjars.bowergithub.mholt:papaparse

CVE-2019-12423 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-jose

CVE-2022-43408 Vulnerability in maven package org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view

CVE-2021-21318 Vulnerability in maven package org.opencastproject:opencast-search-service-impl

Severity

Low

Classification

CWE-367 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory Permissions Required Exploit