PT-2018-4787 · Google · Chromedriver

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10609

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions chromedriver126 version 1.26

Description The issue allows for a man-in-the-middle (MITM) attack due to the insecure download of binary resources over HTTP. This could potentially lead to remote code execution (RCE) if an attacker intercepts the download and replaces the binary with a malicious one. The risk of exploitation is heightened when connected to public networks or if an attacker has a privileged network position.

Recommendations For chromedriver126 version 1.26, consider avoiding the use of this package until a secure version is available. As a temporary mitigation measure, avoid installing this package while connected to a public network to reduce the risk of exploitation. If the package is installed on a private network, ensure that network security is maintained to prevent unauthorized access.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-311

Related Identifiers

CVE-2016-10609

GHSA-JPPX-HW2F-8GX4

Affected Products

Chromedriver

References · 6

• https://osv.dev/vulnerability/CVE-2016-10609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10609 · Security Note
• https://osv.dev/vulnerability/GHSA-jppx-hw2f-8gx4 · Vendor Advisory
• https://npmjs.com/advisories/203 · Note
• https://github.com/advisories/GHSA-jppx-hw2f-8gx4 · Note
• https://nodesecurity.io/advisories/203 · Note