PT-2018-4770 · Jser-Stat · Jser-Stat

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10592

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jser-stat (affected versions not specified)

Description The issue concerns the jser-stat library, which downloads data resources over HTTP, making it susceptible to Man-In-The-Middle (MITM) attacks. In a scenario where an attacker has a privileged network position, they can modify or read resources at will. The impact of this issue can range from reading sensitive information to remote code execution, depending on the package's behavior.

Recommendations To mitigate the risk, avoid using the jser-stat package if possible, and consider using a different package instead. As a temporary measure, reduce the risk of exploitation by not installing this package while connected to a public network. If the package is installed on a private network, minimize the risk by ensuring that only trusted individuals have access to the network. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-310

Related Identifiers

CVE-2016-10592

GHSA-5W4P-H4GM-3W26

Affected Products

Jser-Stat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-10592 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10592 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5w4p-h4gm-3w26 · Vendor Advisory
• https://github.com/jser/stat-js/blob/master/data/url-mapping.js · Note
• https://nodesecurity.io/advisories/188 · Note
• https://npmjs.com/advisories/188 · Note
• https://github.com/advisories/GHSA-5w4p-h4gm-3w26 · Note