PT-2018-4775 · Unknown · Cobalt-Cli

Published 2018-06-01 · Updated 2019-12-03 · CVE-2016-10597

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cobalt-cli versions (affected versions not specified)

Description The issue allows for man-in-the-middle (MITM) attacks due to the insecure download of resources over HTTP. In a scenario where an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one, resulting in code execution on the system running cobalt-cli.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding the use of this package and use a different package if available. Alternatively, reduce the risk of exploitation by ensuring that this package is not installed while connected to a public network.

Missing Encryption of Sensitive Data

Improper Privilege Management

Weakness Enumeration

CWE-311

CWE-269

Related Identifiers

CVE-2016-10597

GHSA-RWVJ-JGC4-FQQ5

Affected Products

Cobalt-Cli

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10597 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10597 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rwvj-jgc4-fqq5 · Vendor Advisory
• https://nodesecurity.io/advisories/197 · Note
• https://github.com/advisories/GHSA-rwvj-jgc4-fqq5 · Note
• https://npmjs.com/advisories/197 · Note