{"answers":{"affected":"2 open source packages ship an affected version, including log4js. It affects 2 products.","exploited":"There is no known exploitation of CVE-2022-21704 in the wild and no public exploit code.","fix":"Upgrade log4js to 6.4.0 or later.","what":"CVE-2022-21704 is a medium-severity vulnerability in Debian Debian Linux, published on 19 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-21704 and fix it if it is affected.\n\nWhat it is: CVE-2022-21704 is a medium-severity vulnerability in Debian Debian Linux, published on 19 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-21704 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- log4js (npm): affected all versions; fixed in 6.4.0\n- log4js (npm): affected all versions; fixed in 6.4.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-21704/ (Markdown: https://insights.sbomify.com/CVE-2022-21704/index.md)","id":"CVE-2022-21704","markdown":"https://insights.sbomify.com/CVE-2022-21704/index.md","name":"CVE-2022-21704","record":{"aliases":["AZL-45261","CLSA-2026-1772583203","CLSA-2026-1788553383","CLSA-2026-1792473187","DEBIAN-CVE-2022-21704","DLA-3229-1","GHSA-82v2-mx6x-wq7q","UBUNTU-CVE-2022-21704"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Node.js logging library","requires_auth":"low_privilege","summary":"Attackers can read sensitive log files because default permissions are world-readable, affecting users who did not explicitly set file modes.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"log4js","vendor":"log4js_project"}],"cvss":{"score":5.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-276","name":"Incorrect Default Permissions"}],"description":"log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Incorrect Default Permissions in log4js-node","id":"CVE-2022-21704","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":"debian:debian_linux","products":["debian:debian_linux"],"type":"information_disclosure","year":"2022"},"n_packages":2,"n_references":5,"next":{"headline":"Authenticated remote code execution in octobercms","id":"CVE-2022-21705"},"packages":[{"ecosystem":"npm","fixed":["6.4.0"],"introduced":["0"],"last_affected":[],"package":"log4js","purl":null,"source":"GHSA-82v2-mx6x-wq7q"},{"ecosystem":"npm","fixed":["6.4.0"],"introduced":["0"],"last_affected":[],"package":"log4js","purl":"pkg:npm/log4js","source":"GHSA-82v2-mx6x-wq7q"}],"prev":{"headline":"Cross Site Request Forgery in Grafana","id":"CVE-2022-21703"},"products":["log4js-node"],"published":"2022-01-19","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-23","vendors":["log4js-node"]},"summary":"Attackers can read sensitive log files because default permissions are world-readable, affecting users who did not explicitly set file modes.","url":"https://insights.sbomify.com/CVE-2022-21704/"}