Search for vulnerabilities
Vulnerability details: VCID-de8e-u8sq-nyby
Vulnerability ID VCID-de8e-u8sq-nyby
Aliases CVE-2023-23920
Summary An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
Status Published
Exploitability 0.5
Weighted Severity 3.8
Risk 1.9
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-426 Untrusted Search Path
System Score Found at
cvssv3 4.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-23920.json
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2023-23920
cvssv3.1 7.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 4.2 https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
cvssv3.1 4.2 https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
ssvc Track https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
cvssv3.1 4.2 https://nvd.nist.gov/vuln/detail/CVE-2023-23920
cvssv3.1 4.2 https://security.netapp.com/advisory/ntap-20230316-0008/
ssvc Track https://security.netapp.com/advisory/ntap-20230316-0008/
cvssv3.1 4.2 https://www.debian.org/security/2023/dsa-5395
ssvc Track https://www.debian.org/security/2023/dsa-5395
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-23920.json
https://api.first.org/data/v1/epss?cve=CVE-2023-23920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1031834 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031834
2172217 https://bugzilla.redhat.com/show_bug.cgi?id=2172217
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2023-23920 https://nvd.nist.gov/vuln/detail/CVE-2023-23920
dsa-5395 https://www.debian.org/security/2023/dsa-5395
february-2023-security-releases https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
msg00038.html https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
ntap-20230316-0008 https://security.netapp.com/advisory/ntap-20230316-0008/
RHSA-2023:1533 https://access.redhat.com/errata/RHSA-2023:1533
RHSA-2023:1582 https://access.redhat.com/errata/RHSA-2023:1582
RHSA-2023:1583 https://access.redhat.com/errata/RHSA-2023:1583
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:1743 https://access.redhat.com/errata/RHSA-2023:1743
RHSA-2023:1744 https://access.redhat.com/errata/RHSA-2023:1744
RHSA-2023:2654 https://access.redhat.com/errata/RHSA-2023:2654
RHSA-2023:2655 https://access.redhat.com/errata/RHSA-2023:2655
RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
USN-6672-1 https://usn.ubuntu.com/6672-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-23920.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T14:22:16Z/ Found at https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T14:22:16Z/ Found at https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-23920
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20230316-0008/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T14:22:16Z/ Found at https://security.netapp.com/advisory/ntap-20230316-0008/
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N Found at https://www.debian.org/security/2023/dsa-5395
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-12T14:22:16Z/ Found at https://www.debian.org/security/2023/dsa-5395
Exploit Prediction Scoring System (EPSS)
Percentile 0.17429
EPSS Score 0.00055
Published At Aug. 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:41:13.310841+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6672-1/ 37.0.0