PT-2018-4730 · Infragistics · Igniteui

Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10552

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions igniteui versions 0.0.5 and earlier

Description The issue concerns the download of JavaScript and CSS resources over an insecure protocol. Specifically, affected versions of igniteui download these resources over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept and view or modify any content sent or received over this unencrypted connection.

Recommendations For igniteui versions 0.0.5 and earlier, consider using the ignite-ui package instead, as igniteui has been deprecated by the package author.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-254

Related Identifiers

CVE-2016-10552

GHSA-2R5H-GH4X-8HP9

Affected Products

Igniteui

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10552 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10552 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r5h-gh4x-8hp9 · Vendor Advisory
• https://npmjs.com/advisories/116 · Note
• https://github.com/advisories/GHSA-2r5h-gh4x-8hp9 · Note
• https://nodesecurity.io/advisories/116 · Note