PT-2018-4766 · Nw.Js · Nw

Publicado 2018-06-01 · Atualizado 2019-10-09 · CVE-2016-10588

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nw versions prior to 0.23.6-1

Description The issue allows for potential remote code execution (RCE) by swapping out the requested zip file with an attacker-controlled binary if the attacker is on the network or positioned in between the user and the remote server. This is possible because nw downloads zipped resources over HTTP. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running nw.

Recommendations Update to version 0.23.6-1 or later.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-310

CWE-311

Identificadores relacionados

CVE-2016-10588

GHSA-HV96-XXX2-5V7W

Produtos afetados

Nw

Referências · 7

• https://github.com/nwjs/npm-installer/commit/adb4df1e012d38a3872578d484291b9af07aad5b · Nota
• https://osv.dev/vulnerability/GHSA-hv96-xxx2-5v7w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10588 · Nota de Segurança
• https://nodesecurity.io/advisories/166 · Nota
• https://npmjs.com/advisories/166 · Nota
• https://github.com/advisories/GHSA-hv96-xxx2-5v7w · Nota
• https://osv.dev/vulnerability/CVE-2016-10588 · Aviso do Fabricante