PT-2018-4808 · Unknown · Install-G-Test

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10630

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions install-g-test versions (affected versions not specified)

Description The issue concerns the insecure download of resources over HTTP, making it susceptible to Man-In-The-Middle (MITM) attacks. In such attacks, an adversary with a privileged network position can modify or read resources at will. The impact severity varies and can range from reading sensitive information to remote code execution, depending on the package's behavior.

Recommendations To mitigate the issue, avoid using this package if possible, and consider using a different package instead. As an alternative, reduce the risk of exploitation by avoiding the installation of this package while connected to a public network. If the package is installed on a private network, ensure that network security is maintained to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-311

Related Identifiers

CVE-2016-10630

GHSA-QJVF-RMWG-64FR

Affected Products

Install-G-Test

References · 6

• https://osv.dev/vulnerability/CVE-2016-10630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10630 · Security Note
• https://osv.dev/vulnerability/GHSA-qjvf-rmwg-64fr · Vendor Advisory
• https://npmjs.com/advisories/228 · Note
• https://nodesecurity.io/advisories/228 · Note
• https://github.com/advisories/GHSA-qjvf-rmwg-64fr · Note