PT-2018-4710 · Airbrake · Airbrake

Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10530

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions airbrake versions 0.3.8 and earlier

Description The issue concerns the airbrake module sending environment variables over HTTP by default. This can lead to the exposure of secret keys and sensitive values to malicious users on the same network, as they can intercept the data. This practice goes against the common best practice of using HTTPS. In scenarios where an attacker has a privileged network position, they can capture and read these environment variables, potentially leaking sensitive information.

Recommendations Update to version 0.4.0 or later. As an alternative, upgrade from the now-deprecated airbrake module to its replacement.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-310

Related Identifiers

CVE-2016-10530

GHSA-856X-CP3Q-47VG

Affected Products

Airbrake

References · 7

• https://osv.dev/vulnerability/CVE-2016-10530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10530 · Security Note
• https://osv.dev/vulnerability/GHSA-856x-cp3q-47vg · Vendor Advisory
• https://github.com/airbrake/node-airbrake/issues/70 · Note
• https://github.com/advisories/GHSA-856x-cp3q-47vg · Note
• https://nodesecurity.io/advisories/96 · Note
• https://npmjs.com/advisories/96 · Note