CVE-2023-23920

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.2 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
Affected Products (NVD)
VendorProductVersion
nodejsnode.js
14.0.0 ≤
𝑥
≤ 14.14.0
nodejsnode.js
14.0.0 ≤
𝑥
< 14.21.3
nodejsnode.js
16.0.0 ≤
𝑥
≤ 16.12.0
nodejsnode.js
16.0.0 ≤
𝑥
< 16.19.1
nodejsnode.js
18.0.0 ≤
𝑥
≤ 18.11.0
nodejsnode.js
18.0.0 ≤
𝑥
< 18.14.1
nodejsnode.js
19.0.0 ≤
𝑥
< 19.6.1
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bookworm
18.19.0+dfsg-6~deb12u2
fixed
bookworm (security)
18.19.0+dfsg-6~deb12u1
fixed
bullseye
12.22.12~dfsg-1~deb11u4
fixed
bullseye (security)
12.22.12~dfsg-1~deb11u5
fixed
sid
20.18.1+dfsg-1
fixed
trixie
20.18.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
bionic
not-affected
focal
Fixed 10.19.0~dfsg-3ubuntu1.5
released
jammy
Fixed 12.22.9~dfsg-1ubuntu3.4
released
kinetic
ignored
lunar
ignored
mantic
Fixed 18.13.0+dfsg1-1ubuntu2.1
released
noble
not-affected
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
nodejs10
suse enterprise server 15 SP1
10.24.1-150000.1.56.1
fixed
suse enterprise server 15 SP2
10.24.1-150000.1.56.1
fixed
nodejs10-devel
suse enterprise server 15 SP1
10.24.1-150000.1.56.1
fixed
suse enterprise server 15 SP2
10.24.1-150000.1.56.1
fixed
nodejs10-docs
suse enterprise server 15 SP1
10.24.1-150000.1.56.1
fixed
suse enterprise server 15 SP2
10.24.1-150000.1.56.1
fixed
nodejs12
suse enterprise server 15 SP2
12.22.12-150200.4.44.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.44.1
fixed
nodejs12-devel
suse enterprise server 15 SP2
12.22.12-150200.4.44.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.44.1
fixed
nodejs12-docs
suse enterprise server 15 SP2
12.22.12-150200.4.44.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.44.1
fixed
nodejs14
suse enterprise server 15 SP2
14.21.3-150200.15.43.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.43.1
fixed
nodejs14-devel
suse enterprise server 15 SP2
14.21.3-150200.15.43.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.43.1
fixed
nodejs14-docs
suse enterprise server 15 SP2
14.21.3-150200.15.43.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.43.1
fixed
nodejs16
suse enterprise sap 15 SP4
16.19.1-150400.3.15.1
fixed
suse enterprise server 15 SP3
16.19.1-150300.7.18.1
fixed
suse enterprise server 15 SP4
16.19.1-150400.3.15.1
fixed
nodejs16-devel
suse enterprise sap 15 SP4
16.19.1-150400.3.15.1
fixed
suse enterprise server 15 SP3
16.19.1-150300.7.18.1
fixed
suse enterprise server 15 SP4
16.19.1-150400.3.15.1
fixed
nodejs16-docs
suse enterprise sap 15 SP4
16.19.1-150400.3.15.1
fixed
suse enterprise server 15 SP3
16.19.1-150300.7.18.1
fixed
suse enterprise server 15 SP4
16.19.1-150400.3.15.1
fixed
nodejs18
suse enterprise sap 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise sap 15 SP5
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP5
18.14.2-150400.9.6.2
fixed
nodejs18-devel
suse enterprise sap 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise sap 15 SP5
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP5
18.14.2-150400.9.6.2
fixed
nodejs18-docs
suse enterprise sap 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise sap 15 SP5
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP5
18.14.2-150400.9.6.2
fixed
npm10
suse enterprise server 15 SP1
10.24.1-150000.1.56.1
fixed
suse enterprise server 15 SP2
10.24.1-150000.1.56.1
fixed
npm12
suse enterprise server 15 SP2
12.22.12-150200.4.44.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.44.1
fixed
npm14
suse enterprise server 15 SP2
14.21.3-150200.15.43.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.43.1
fixed
npm16
suse enterprise sap 15 SP4
16.19.1-150400.3.15.1
fixed
suse enterprise server 15 SP3
16.19.1-150300.7.18.1
fixed
suse enterprise server 15 SP4
16.19.1-150400.3.15.1
fixed
npm18
suse enterprise sap 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise sap 15 SP5
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP4
18.14.2-150400.9.6.2
fixed
suse enterprise server 15 SP5
18.14.2-150400.9.6.2
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
nodejs
RHEL 9
1:16.19.1-1.el9_2
fixed
nodejs-docs
RHEL 9
1:16.19.1-1.el9_2
fixed
nodejs-full-i18n
RHEL 9
1:16.19.1-1.el9_2
fixed
nodejs-libs
RHEL 9
1:16.19.1-1.el9_2
fixed
nodejs-nodemon
RHEL 9
0:2.0.20-3.el9_2
fixed
npm
RHEL 9
1:8.19.3-1.16.19.1.1.el9_2
fixed
Common Weakness Enumeration
References
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
https://security.netapp.com/advisory/ntap-20230316-0008/
https://www.debian.org/security/2023/dsa-5395
https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
https://security.netapp.com/advisory/ntap-20230316-0008/
https://www.debian.org/security/2023/dsa-5395