Lucene search

HackeroneCVE-2016-10673

HistoryJun 04, 2018 - 4:29 p.m.

CVE-2016-10673

2018-06-0416:29:01

CWE-311

CWE-310

hackerone

web.nvd.nist.gov

cve-2016-10673

ipip-coffee

geolocation

http

mitm

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.

Affected configurations

Nvd

Node

ipipipip-coffeeRange≤1.0.9node.js

VendorProductVersionCPE
ipipipip-coffee*cpe:2.3:a:ipip:ipip-coffee:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
ipip	ipip-coffee	*	cpe:2.3:a:ipip:ipip-coffee::::::node.js::*

CNA Affected

[
  {
    "product": "ipip-coffee node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

nodesecurity.io/advisories/279

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

44.6%

JSON

Related for CVE-2016-10673