PT-2018-4816 · Js Given · Js-Given

Published 2018-06-04 · Updated 2019-10-09 · CVE-2016-10638

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions js-given versions prior to 0.0.18

Description The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. If an attacker is positioned on the network or between the user and the remote server, they may swap the requested binary with a malicious one, potentially leading to remote code execution (RCE) on the system running js-given.

Recommendations Update to version 0.0.18 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-310

Related Identifiers

CVE-2016-10638

GHSA-RQWH-C535-J9HW

Affected Products

Js-Given

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10638 · Security Note
• https://osv.dev/vulnerability/GHSA-rqwh-c535-j9hw · Vendor Advisory
• https://github.com/jsGiven/jsGiven/commit/92f750739c7b9b6e704e562ad34e2ad148acad64) · Note
• https://github.com/advisories/GHSA-rqwh-c535-j9hw · Note
• https://npmjs.com/advisories/241 · Note
• https://nodesecurity.io/advisories/241 · Note