CVE-2023-23920:
CVE-2023-23920 is a vulnerability, with a CVSS 3.1 base score of 4.2 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.45% probability of exploitation activity in the next 30 days, higher than 39% of all scored vulnerabilities. Microsoft released the fix on 27 February 2023 in the March 2023 Patch Tuesday. It affects 4 products in 1 product family (Mariner).
Key facts
- CVE ID
- CVE-2023-23920
- Severity
- Medium CVSS 4.2
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-426
- EPSS
- 0.45% (percentile 39%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- March 2023 Patch Tuesday
- Product families
- Mariner
CVSS score and vector
Microsoft scores CVE-2023-23920 at 4.2 (temporal 4.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | None |
Affected products (4)
Mariner
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| CBL Mariner 2.0 x64 | nodejs | CBL-Mariner | 16.19.1-1 | |
| CBL Mariner 2.0 ARM | nodejs | CBL-Mariner | 16.19.1-1 | |
| CBL Mariner 1.0 x64 | nodejs | CBL-Mariner | 14.21.3-1 | |
| CBL Mariner 1.0 ARM | nodejs | CBL-Mariner | 14.21.3-1 |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 4.2 (MEDIUM)
- NVD weakness
- CWE-426
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| node.js | from 14.0.0, up to and including 14.14.0 |
| node.js | from 14.0.0, before 14.21.3 |
| node.js | from 16.0.0, up to and including 16.12.0 |
| node.js | from 16.0.0, before 16.19.1 |
| node.js | from 18.0.0, up to and including 18.11.0 |
| node.js | from 18.0.0, before 18.14.1 |
| node.js | from 19.0.0, before 19.6.1 |
| debian linux 10.0 | all listed versions |
References
- https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (Mailing List)
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (Patch, Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20230316-0008/
- https://www.debian.org/security/2023/dsa-5395
- https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html (Mailing List)
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ (Patch, Vendor Advisory)
- https://security.netapp.com/advisory/ntap-20230316-0008/
- https://www.debian.org/security/2023/dsa-5395
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Added nodejs to CBL-Mariner 1.0 | |
| 1.2 | Information published. |