PT-2018-6154 · Npm · Botbait

Publicado 2018-06-07 · Atualizado 2020-09-01 · CVE-2017-16126

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: botbait (affected versions not specified)

Description: The module botbait is a tool used to track bot and automated tools usage within the npm ecosystem. It records and tracks user information, including source IP, process.versions, process.platform, and how the module was invoked.

Recommendations: Remove the botbait package from your environment if discovered, as it has no functional value.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-16126

GHSA-4R5X-QJQC-P579

Produtos afetados

Botbait

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-16126 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4r5x-qjqc-p579 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16126 · Aviso do Fabricante
• https://web.archive.org/web/20210120201359/https://npmjs.com/advisories/483 · Nota
• https://nodesecurity.io/advisories/483 · Nota