PT-2020-7932 · Unknown · Ezseed-Transmission

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000224

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ezseed-transmission versions prior to 0.0.15

Description: The issue allows an attacker in a privileged network position to launch a Man-in-the-Middle attack, intercepting a script downloaded over an HTTP connection and potentially replacing it with malicious code. This could completely compromise the system running the affected software.

Recommendations: Update to version 0.0.15 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-300

CWE-295

Related Identifiers

CVE-2016-1000224

GHSA-P788-RJ37-357W

Affected Products

Ezseed-Transmission

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-1000224 · Security Note
• https://osv.dev/vulnerability/GHSA-p788-rj37-357w · Vendor Advisory
• https://npmjs.com/advisories/114 · Note
• https://snyk.io/vuln/npm:ezseed-transmission:20160729 · Note