PT-2018-6069 · Ikst · Ikst

Publicado 2018-06-04 · Atualizado 2019-10-09 · CVE-2017-16041

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ikst versions prior to 1.1.2

Description: The issue allows for insecure downloading of resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. The impact can range from reading sensitive information to remote code execution, depending on the package's behavior.

Recommendations: Upgrade to version 1.1.2 or greater.

Correção

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-319

CWE-311

Identificadores relacionados

CVE-2017-16041

GHSA-W23F-F3C5-R9QH

Produtos afetados

Ikst

Referências · 6

• https://npmjs.com/advisories/249 · Nota
• https://nodesecurity.io/advisories/249 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16041 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w23f-f3c5-r9qh · Aviso do Fabricante
• https://github.com/advisories/GHSA-w23f-f3c5-r9qh · Nota
• https://osv.dev/vulnerability/CVE-2017-16041 · Aviso do Fabricante