Описание
nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 0.23.6-1 (исключая)
cpe:2.3:a:nwjs:nw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 75%
0.00863
Низкий
8.1 High
CVSS3
9.3 Critical
CVSS2
Дефекты
CWE-311
CWE-310
Связанные уязвимости
EPSS
Процентиль: 75%
0.00863
Низкий
8.1 High
CVSS3
9.3 Critical
CVSS2
Дефекты
CWE-311
CWE-310