CVE-2023-23918: node.js from 14.0.0 (inclusive), through 14.14.0 (inclusive), from 14.0.0 (inclusive), before 14.21.3 (exclusive)…

Affected technology

node.js · from 14.0.0 (inclusive), through 14.14.0 (inclusive)
nodejs

node.js · from 14.0.0 (inclusive), before 14.21.3 (exclusive)
nodejs

node.js · from 16.0.0 (inclusive), through 16.12.0 (inclusive)
nodejs

node.js · from 16.0.0 (inclusive), before 16.19.1 (exclusive)
nodejs

node.js · from 18.0.0 (inclusive), through 18.11.0 (inclusive)
nodejs

node.js · from 18.0.0 (inclusive), before 18.14.1 (exclusive)
nodejs

node.js · from 19.0.0 (inclusive), before 19.6.1 (exclusive)
nodejs

Node · 4.0 to before 4.*, 5.0 to before 5.*, 6.0 to before 6.*, 7.0 to before 7.*, 8.0 to before 8.*, 9.0 to before 9.*, 10.0 to before 10.*, 11.0 to before 11.*, 12.0 to before 12.*, 13.0 to before 13.*, 14.0 to before 14.21.3, 15.0 to before 15.*, 16.0 to before 16.19.1, 17.0 to before 17.*, 18.0 to before 18.14.1, 19.0 to before 19.6.1
NodeJS

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could gain higher privileges under the conditions described by the source. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.