PT-2018-4730 · Infragistics · Igniteui

Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10552

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions igniteui versions 0.0.5 and earlier

Description The issue concerns the download of JavaScript and CSS resources over an insecure protocol. Specifically, affected versions of igniteui download these resources over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept and view or modify any content sent or received over this unencrypted connection.

Recommendations For igniteui versions 0.0.5 and earlier, consider using the ignite-ui package instead, as igniteui has been deprecated by the package author.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

CWE-254

Identificadores relacionados

CVE-2016-10552

GHSA-2R5H-GH4X-8HP9

Produtos afetados

Igniteui

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10552 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10552 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2r5h-gh4x-8hp9 · Aviso do Fabricante
• https://npmjs.com/advisories/116 · Nota
• https://github.com/advisories/GHSA-2r5h-gh4x-8hp9 · Nota
• https://nodesecurity.io/advisories/116 · Nota