CVE-2024-22017
Assigner: hackerone
Published: 2024-03-19T04:32:34.137Z
State: PUBLISHED
descriptions: value: setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
affected: vendor: Node.js
product: Node.js
versions: version: 18.18.0
status: affected
lessThanOrEqual: 18.18.0
versionType: semver
version: 20.4.0
status: unaffected
lessThanOrEqual: 20.4.0
versionType: semver
version: 21.6.1
status: unaffected
lessThanOrEqual: 21.6.1
versionType: semver
metrics: cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
baseScore: 7.3
baseSeverity: HIGH