PT-2018-4788 · Unknown · Unicode-Json

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10610

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions unicode-json versions prior to 2.0.0

Description The issue concerns the insecure download of data resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. The impact of this issue can range from reading sensitive information to remote code execution, depending on the package's behavior.

Recommendations For unicode-json versions prior to 2.0.0, install version 2.0.0 or greater.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-311

Related Identifiers

CVE-2016-10610

GHSA-HW4R-XR38-HM8J

Affected Products

Unicode-Json

References · 6

• https://osv.dev/vulnerability/CVE-2016-10610 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hw4r-xr38-hm8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10610 · Security Note
• https://github.com/advisories/GHSA-hw4r-xr38-hm8j · Note
• https://npmjs.com/advisories/206 · Note
• https://nodesecurity.io/advisories/206 · Note