CVE-2016-10580

Опубликовано: 01 июн. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 9.3

EPSS Низкий

Описание

nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.

Ссылки

https://nodesecurity.io/advisories/173
Third Party Advisory
https://nodesecurity.io/advisories/173
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nodewebkit_project:nodewebkit:*:*:*:*:*:node.js:*:*

Версия до 0.11.2-1 (включая)

EPSS

Процентиль: 66%

0.00518

Низкий

8.1 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-311

CWE-310

Связанные уязвимости

GHSA-gc6c-5v9w-xmhw

github

почти 7 лет назад

Downloads Resources over HTTP in nodewebkit