OpenSSL engines can be used to bypass and/or disable the permission model

访问控制 / 权限提升 / #1954535

厂商

Node.js

严重程度

低危 · CVSS 6.3

赏金

—

弱点

权限提升

研究员

@tniessen

披露日期

2023-06-22

资产

https://github.com/nodejs/node

CVE

CVE-2023-30586

该报告还没有中文解读。

**Summary:** Node.js 20 allows loading arbitrary OpenSSL engines even when the permission model is enabled, which can bypass and/or disable the permission model.