CVE-2022-21704
Medium
Description
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Log4js
PublishedJan 19, 2022
First seenJan 19, 2022
Weakness typeCWE-276CWE-276
How to fix
Update
- log4js_project log4js6.4.0 or later
- log4js6.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| log4js_project log4js | v < 6.4.0 | 6.4.0 |
| debian debian_linux | 10.0 | — |
| log4jsnpm | v < 6.4.0 | 6.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.