PT-2018-4787 · Google · Chromedriver

Publicado 2018-06-01 · Atualizado 2019-10-09 · CVE-2016-10609

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions chromedriver126 version 1.26

Description The issue allows for a man-in-the-middle (MITM) attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution (RCE) if an attacker intercepts the download and replaces the binary with a malicious one. The risk of exploitation is heightened when connected to public networks or if an attacker has a privileged network position.

Recommendations For chromedriver126 version 1.26, consider avoiding the use of this package until a secure version is available. As a temporary mitigation measure, avoid installing this package while connected to a public network to reduce the risk of exploitation. If the package is installed on a private network, ensure that network security is maintained to prevent unauthorized access.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-310

CWE-311

Identificadores relacionados

CVE-2016-10609

GHSA-JPPX-HW2F-8GX4

Produtos afetados

Chromedriver

Referências · 6

• https://npmjs.com/advisories/203 · Nota
• https://osv.dev/vulnerability/CVE-2016-10609 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10609 · Nota de Segurança
• https://github.com/advisories/GHSA-jppx-hw2f-8gx4 · Nota
• https://osv.dev/vulnerability/GHSA-jppx-hw2f-8gx4 · Aviso do Fabricante
• https://nodesecurity.io/advisories/203 · Nota