PT-2016-3267 · Console Io · Console-Io

Publicado 2016-04-19 · Atualizado 2019-02-18 · CVE-2016-10532

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions console-io versions 2.2.13 and earlier

Description The issue is related to a lack of proper authentication configuration in the console-io module, allowing a malicious user to bypass authentication and execute commands on the system. This could lead to full system access if the console-io application is run from a privileged account. The vulnerability is due to the console-io application not requiring authentication for socket.io connections, enabling malicious users to send commands and receive responses via a websocket.

Recommendations Update to version 2.3.0 or later. As a temporary workaround, consider disabling the websocket connection to the console-io application until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2018-00919

CVE-2016-10532

GHSA-Q52J-4Q2Q-HCJ6

Produtos afetados

Console-Io

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-10532 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10532 · Aviso do Fabricante
• https://github.com/advisories/GHSA-q52j-4q2q-hcj6 · Nota
• https://bdu.fstec.ru/vul/2018-00919 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q52j-4q2q-hcj6 · Aviso do Fabricante
• https://nodesecurity.io/advisories/90 · Nota
• https://npmjs.com/advisories/90 · Nota