CVE-2022-21704

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.

• CWE-276
• CWE-276

• https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640Release Notes, Third Party Advisory
• https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76Patch, Third Party Advisory
• https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7qPatch, Third Party Advisory
• https://github.com/log4js-node/streamroller/pull/87Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00014.htmlMailing List, Third Party Advisory
• https://github.com/log4js-node/log4js-node/blob/v6.4.0/CHANGELOG.md#640Release Notes, Third Party Advisory
• https://github.com/log4js-node/log4js-node/pull/1141/commits/8042252861a1b65adb66931fdf702ead34fa9b76Patch, Third Party Advisory
• https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7qPatch, Third Party Advisory
• https://github.com/log4js-node/streamroller/pull/87Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00014.htmlMailing List, Third Party Advisory

Published

Jan 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21699IPython (Interactive Python) is a command shell for interact…8.8
• CVE-2022-2170The Microsoft Advertising Universal Event Tracking (UET) Wor…4.8
• CVE-2022-21700Micronaut is a JVM-based, full stack Java framework designed…5.3
• CVE-2022-21701Istio is an open platform to connect, manage, and secure mic…8.8
• CVE-2022-21702Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-21703Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-21705Octobercms is a self-hosted CMS platform based on the Larave…7.2
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21707wasmCloud Host Runtime is a server process that securely hos…8.1
• CVE-2022-21708graphql-go is a GraphQL server with a focus on ease of use. …6.5
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21710ShortDescription is a MediaWiki extension that provides loca…6.1