-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe primary source of information, the Node.js security advisory for CVE-2023-46809, explicitly names the 'privateDecrypt()' API of the crypto library as the vulnerable component within Node.js. This API serves as the interface to the underlying OpenSSL functions where the timing attack vulnerability (Marvin Attack) resides. Therefore, in a Node.js runtime environment, crypto.privateDecrypt is the function that would be invoked to trigger the vulnerability. The fix was an update to the OpenSSL library used by Node.js, rather than a direct code change in the JavaScript or C++ implementation of 'privateDecrypt' itself, but this function remains the relevant indicator in a Node.js runtime profile.
Ongoing coverage of React2Shell