CVE-2022-21704
Incorrect Default Permissions in log4js-node
- State
- Published
- Severity
- 5.5 Medium
- Published
- Jan 19, 2022
- Updated
- Apr 23, 2025
- Reserved
- Nov 16, 2021
Description
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
log4js-nodelog4js-node |
|
References
- https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q
- https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76
- https://github.com/log4js-node/streamroller/pull/87
- https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640
- [debian-lts-announce] 20221206 [SECURITY] [DLA 3229-1] node-log4js security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.