PT-2018-4838 · Fis · Fis-Parser-Sass-Bin
Publicado
2018-06-04
·
Atualizado
2019-10-09
·
CVE-2016-10660
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
fis-parser-sass-bin (affected versions not specified)
Description
The issue arises from fis-parser-sass-bin downloading binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts the request and replaces the resources with a malicious version. The vulnerability can be exploited when an attacker has a privileged network position, allowing them to intercept and alter the response, resulting in code execution on the system running fis-parser-sass-bin.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
To mitigate the risk, consider avoiding the use of this package and opt for a different package if available.
Alternatively, reduce the risk of exploitation by avoiding installation of this package while connected to a public network, and be cautious of potential exploitation if the package is installed on a private network.
Missing Encryption of Sensitive Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fis-Parser-Sass-Bin