PT-2018-4838 · Fis · Fis-Parser-Sass-Bin

Published 2018-06-04 · Updated 2019-10-09 · CVE-2016-10660

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions fis-parser-sass-bin (affected versions not specified)

Description The issue arises from fis-parser-sass-bin downloading binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts the request and replaces the resources with a malicious version. The vulnerability can be exploited when an attacker has a privileged network position, allowing them to intercept and alter the response, resulting in code execution on the system running fis-parser-sass-bin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. To mitigate the risk, consider avoiding the use of this package and opt for a different package if available. Alternatively, reduce the risk of exploitation by avoiding installation of this package while connected to a public network, and be cautious of potential exploitation if the package is installed on a private network.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-310

Related Identifiers

CVE-2016-10660

GHSA-5PQ8-2Q24-MJ3P

Affected Products

Fis-Parser-Sass-Bin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-10660 · Security Note
• https://osv.dev/vulnerability/GHSA-5pq8-2q24-mj3p · Vendor Advisory
• https://npmjs.com/advisories/269 · Note
• https://github.com/advisories/GHSA-5pq8-2q24-mj3p · Note
• https://nodesecurity.io/advisories/269 · Note