Vulnerability · Published Nov 23, 2023 · Assigned by mitre
CVE-2023-49210
Critical 9.8
In plain English
A critical-severity security flaw in the openssl package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.9%top 20.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | openssl | no fix listed | GHSA-75w2-qv55-x7fv |