CVE-2023-49210 - Vulnerability Details - OpenCVE

The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0035.

Key SSVC decision points have not yet been added.

Vendors	Products
Node-openssl Project	Node-openssl

Configuration 1 [-]

cpe:2.3:a:node-openssl_project:node-openssl:*:*:*:*:*:node.js:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e
https://github.com/ossf/malicious-packages/tree/main/malicious/npm
https://www.npmjs.com/package/openssl

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00633}`	epss `{'score': 0.0035}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-11-23T00:00:00

Updated: 2024-08-02T21:53:44.706Z

Reserved: 2023-11-23T00:00:00

Link: CVE-2023-49210

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-11-23T20:15:07.157

Modified: 2024-11-21T08:33:01.917

Link: CVE-2023-49210

Redhat

No data.

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:node-openssl_project:node-openssl:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6BC1E54D-5E58-4AAF-91F2-689D0B1897B4", "versionEndIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as \"a nonsense wrapper with no real purpose\" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": "El paquete NPM openssl (tambi\u00e9n conocido como node-openssl) hasta 2.0.0 fue caracterizado por su autor como \"un contenedor sin sentido sin ning\u00fan prop\u00f3sito real\" y acepta un argumento opts que contiene un campo verbal (usado para la ejecuci\u00f3n de comandos). NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante."}], "id": "CVE-2023-49210", "lastModified": "2024-11-21T08:33:01.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-23T20:15:07.157", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/ossf/malicious-packages/tree/main/malicious/npm"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.npmjs.com/package/openssl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/ossf/malicious-packages/tree/main/malicious/npm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.npmjs.com/package/openssl"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}