It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-304 advisory.

    The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32002)

    The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside     of the policy.json definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32006)

    The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal     modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the     limits defined in a policy.json file.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Impacts

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32559)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-304)

critical Nessus Plugin ID 180113

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.5 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.4 Sep 26, 2023, 8:16 PM CVSS metrics ("CVSSv2 score" changed from 7.5 to 10.0. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2023-32559" to "CVE-2023-32002") CVSSv3 score source (set to "CVE-2023-32002") Plugin Feed: 202309262016
Version 1.3 Sep 18, 2023, 4:18 PM CVSS metrics ("CVSSv2 score" changed from 10.0 to 7.5. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") Plugin Feed: 202309181618
Version 1.2 Sep 4, 2023, 4:15 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2023-32002" to "CVE-2023-32559") CVSSv3 score source (set to "CVE-2023-32559") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309041615
Version 1.1 Aug 25, 2023, 4:05 PM CVSS metrics ("CVSSv2 score" changed from 9.0 to 10.0. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C". "CVSSv3 score" changed from 8.8 to 9.8. "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-32006" to "CVE-2023-32002") CVSSv3 score source (set to "CVE-2023-32002") Plugin Feed: 202308251605
Version 1.0 Aug 24, 2023, 8:11 AM New Plugin Feed: 202308240811