CVE-2024-22017

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Metrics

CVSS 3.0 7.3/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published: Mar 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-220182.9A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. CVE-2024-220197.5A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour CVE-2024-22025.4The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions CVE-2024-220206.5A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can e CVE-2024-220214.3Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Sco CVE-2024-220228.8Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash CVE-2024-220235.3An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unaut CVE-2024-220248.3An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and CVE-2024-220256.5A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet CVE-2024-220266.7A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut CVE-2024-220276.5Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a CVE-2024-220284.6Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is no