CVE-2013-4116

Published: Apr 22, 2014Modified: May 6, 2026

3.3

Vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 3.4 / Impact: 4.9

Source: NVD

Description

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

Affected (1)

Products: Node Packaged Modules Project: Node Packaged Modules

Node Packaged Modules Project

1 product

Node Packaged Modules

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Node Packaged Modules Project Node Packaged Modules	Before 1.3.3

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (16)

http://www.openwall.com/lists/oss-security/2013/07/10/17

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2013/07/11/9

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/61083

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=983917

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/87141

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://github.com/npm/npm/commit/f4d31693

Source: secalert@redhat.com

PatchThird Party Advisory

https://github.com/npm/npm/issues/3635

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2013/07/10/17