PT-2018-4746 · Unknown · Geoip-Lite-Country

Published 2018-05-29 · Updated 2019-10-09 · CVE-2016-10568

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions geoip-lite-country versions prior to 1.1.4

Description The issue concerns the insecure download of data resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. The impact of this issue can range from being able to read sensitive information to remote code execution, depending on the package's behavior.

Recommendations Update to version 1.1.4 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-310

Related Identifiers

CVE-2016-10568

GHSA-FF29-F57W-2MM3

Affected Products

Geoip-Lite-Country

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10568 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ff29-f57w-2mm3 · Vendor Advisory
• https://github.com/advisories/GHSA-ff29-f57w-2mm3 · Note
• https://nodesecurity.io/advisories/183 · Note
• https://npmjs.com/advisories/183 · Note