PT-2018-4710 · Airbrake · Airbrake

Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10530

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions airbrake versions 0.3.8 and earlier

Description The issue concerns the airbrake module sending environment variables over HTTP by default. This can lead to the exposure of secret keys and sensitive values to malicious users on the same network, as they can intercept the data. This practice goes against the common best practice of using HTTPS. In scenarios where an attacker has a privileged network position, they can capture and read these environment variables, potentially leaking sensitive information.

Recommendations Update to version 0.4.0 or later. As an alternative, upgrade from the now-deprecated airbrake module to its replacement.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-310

Identificadores relacionados

CVE-2016-10530

GHSA-856X-CP3Q-47VG

Produtos afetados

Airbrake

Referências · 7

• https://github.com/airbrake/node-airbrake/issues/70 · Nota
• https://github.com/advisories/GHSA-856x-cp3q-47vg · Nota
• https://osv.dev/vulnerability/CVE-2016-10530 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10530 · Nota de Segurança
• https://nodesecurity.io/advisories/96 · Nota
• https://npmjs.com/advisories/96 · Nota
• https://osv.dev/vulnerability/GHSA-856x-cp3q-47vg · Aviso do Fabricante