What is the CVSS score of CVE-2024-34346?

CVE-2024-34346 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2024-34346?

Yes, a patch is available for CVE-2024-34346. Update the affected software to the latest version immediately.

Deno CVE-2024-34346

CRITICAL

Incorrect Authorization (CWE-863)

2024-05-07 security-advisories@github.com

Authentication Bypass Microsoft Deno

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 07, 2024 - 21:15 nvd

CRITICAL 9.0

DescriptionNVD

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent to --allow-all. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with --allow-read or --allow-write may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit --allow-all access to read or write /etc, /dev on unix platform (as well as /proc and /sys on linux platforms), and any path starting with \\ on Windows.

AnalysisAI

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Rated critical severity (CVSS 9.0), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent to --allow-all. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with --allow-read or --allow-write may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit --allow-all access to read or write /etc, /dev on unix platform (as well as /proc and /sys on linux platforms), and any path starting with \\ on Windows. Affected products include: Deno.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.