PT-2018-4816 · Js Given · Js-Given

Publicado 2018-06-04 · Atualizado 2019-10-09 · CVE-2016-10638

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions js-given versions prior to 0.0.18

Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. If an attacker is positioned on the network or between the user and the remote server, they may swap the requested binary with a malicious one, potentially leading to remote code execution (RCE) on the system running js-given.

Recommendations Update to version 0.0.18 or later.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

CWE-310

Identificadores relacionados

CVE-2016-10638

GHSA-RQWH-C535-J9HW

Produtos afetados

Js-Given

Referências · 6

• https://github.com/jsGiven/jsGiven/commit/92f750739c7b9b6e704e562ad34e2ad148acad64) · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10638 · Nota de Segurança
• https://github.com/advisories/GHSA-rqwh-c535-j9hw · Nota
• https://osv.dev/vulnerability/GHSA-rqwh-c535-j9hw · Aviso do Fabricante
• https://npmjs.com/advisories/241 · Nota
• https://nodesecurity.io/advisories/241 · Nota