CVE-2013-4116: node_packaged_modules_project node_packaged_modules Link Following

CVSS: 3.3v2.0LowModified

AliasesUBUNTU-CVE-2013-4116DEBIAN-CVE-2013-4116CGA-gppp-m277-3q34+156 more

Published 22-04-2014Last modified 06-08-2024

Vulnerability summary

CVE-2013-4116 is a low (CVSS 3.3) Link Following vulnerability in node_packaged_modules_project node_packaged_modules. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.7% of scored vulnerabilities.

Overall risk

13/100

0100

Low · default modelHow is this calculated?

CVSS score

3.3/10

010

Low · v2.0 (NVD)

EPSS score

0.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 9

CGA-3FHQ-X3G3-XXPF CGA-5CR8-CV92-8CJJ CGA-5PR3-FJWR-38Q2 CGA-8GG5-RVX4-4G3V CGA-FGX2-FQ76-JH89 CGA-GVFM-8C69-6984+3 more

Timeline

22-04-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVSS metrics

1 score · 1 source · 1 version

v2.03.3

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

0.00 pp

From 0.37% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected systems

Chainguard72 products

code-serverAll versions (No fix recorded)
code-server-compatAll versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)

commercial-gitlab-rails-ee-assets-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.2All versions (No fix recorded)
gitlab-rails-ce-18.3All versions (No fix recorded)
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-18.10All versions (No fix recorded)
gitlab-rails-ce-assets-18.11All versions (No fix recorded)
gitlab-rails-ce-assets-18.2All versions (No fix recorded)
gitlab-rails-ce-assets-18.3All versions (No fix recorded)
gitlab-rails-ce-assets-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-19.0All versions (No fix recorded)
gitlab-rails-ce-assets-19.1All versions (No fix recorded)
gitlab-rails-ce-assets-19.2All versions (No fix recorded)
gitlab-rails-ce-assets-19.3All versions (No fix recorded)
gitlab-rails-ce-assets-19.4All versions (No fix recorded)
gitlab-rails-ce-assets-19.5All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.2All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.3All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.5All versions (No fix recorded)
gitlab-rails-ce-doc-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-18.2All versions (No fix recorded)
gitlab-rails-ce-doc-18.3All versions (No fix recorded)
gitlab-rails-ce-doc-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-18.7All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)

Show all 72

Wolfi2 products

code-serverAll versions (No fix recorded)
code-server-compatAll versions (No fix recorded)

Debian1 product

npm< 1.3.10~dfsg-1

Node_packaged_modules_project1 product

node_packaged_modules< 1.3.3

Npm1 product

npm< 1.3.3

Ubuntu1 product

npm< 1.3.10~dfsg-1 | < 3.5.2-0ubuntu4

6 vendors · 78 products

References

15 links

www.securityfocus.com/bid/61083VDB EntryX Refsource BIDThird Party AdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=983917X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2013/07/11/9Mailing ListX Refsource MLISTThird Party AdvisoryWEB
bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEB
github.com/npm/npm/issues/3635X Refsource CONFIRMThird Party AdvisoryWEB
github.com/npm/npm/commit/f4d31693X Refsource CONFIRMPatchThird Party AdvisoryWEB
www.openwall.com/lists/oss-security/2013/07/10/17Mailing ListX Refsource MLISTThird Party AdvisoryWEB
exchange.xforce.ibmcloud.com/vulnerabilities/87141VDB EntryX Refsource XFThird Party AdvisoryWEB
ubuntu.com/security/CVE-2013-4116REPORT
github.com/isaacs/npm/issues/3635REPORT

Show all 15 references

www.cve.org/CVERecord?id=CVE-2013-4116REPORT
security-tracker.debian.org/tracker/CVE-2013-4116Advisory
nvd.nist.gov/vuln/detail/CVE-2013-4116Advisory
github.com/npm/npmPACKAGE
www.npmjs.com/advisories/152WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities