CVE-2023-30581

描述

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

如何修補 CVE-2023-30581

要修補 CVE-2023-30581,請將受影響套件升級到下列已修補版本。

• —升級至 16.20.1 或更新版本
• —升級至 16.20.1 或更新版本
• —未列出修補版本

CVE-2023-30581 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• >= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
• >= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
• from 0

CVSS 分數

參考連結(4)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-30581
• WEBnodejs.org/en/blog/vulnerability/june-2023-security-releases
• WEBnvd.nist.gov/vuln/detail/CVE-2023-30581
• WEBsecurity.netapp.com/advisory/ntap-20241101-0011/