PT-2018-6069 · Ikst · Ikst

Published 2018-06-04 · Updated 2019-10-09 · CVE-2017-16041

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ikst versions prior to 1.1.2

Description: The issue allows for insecure downloading of resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. The impact can range from reading sensitive information to remote code execution, depending on the package's behavior.

Recommendations: Upgrade to version 1.1.2 or greater.

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

CVE-2017-16041

GHSA-W23F-F3C5-R9QH

Affected Products

Ikst

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-16041 · Security Note
• https://osv.dev/vulnerability/GHSA-w23f-f3c5-r9qh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16041 · Vendor Advisory
• https://npmjs.com/advisories/249 · Note
• https://nodesecurity.io/advisories/249 · Note
• https://github.com/advisories/GHSA-w23f-f3c5-r9qh · Note