Detections
Analytics

SCA: security update for log4js (GHSA-82v2-mx6x-wq7q)

medium Tenable Self-Hosted Container Security Plugin ID 412375

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files
 created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause
 problems if log files contain sensitive information. This would affect any users that have not supplied
 their own permissions for the files via the mode parameter in the config. Users are advised to update.
 (CVE-2022-21704)

See Also

https://github.com/advisories/GHSA-82v2-mx6x-wq7q

Plugin Details

Severity: Medium

ID: 412375

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2022-21704

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/21/2022

Vulnerability Publication Date: 1/19/2022

Reference Information

CVE: CVE-2022-21704

cwe: CWE-276