CVE-2024-37372: The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true

Low severity · published Jan 9, 2025

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true

3.6

CVSS

0.5%

EPSS

On KEV

Description

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack vector

Local

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 42% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Node · NodeJS

4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +12 more · source: vendor

Affected product

Node

NodeJS

All Node CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-37372

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-37372

www.openwall.com

http://www.openwall.com/lists/oss-security/2024/07/11/6

www.openwall.com

http://www.openwall.com/lists/oss-security/2024/07/19/3

security.netapp.com

https://security.netapp.com/advisory/ntap-20250502-0010/