GitHub Advisoryadvisory · npm

GHSA-2wrq-wmqf-8vcc Downloads Resources over HTTP in operadriver

HIGH Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10565
Ecosystem
npm
Packages
operadriver
Severity
High
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm operadriver: < 0.2.3 → fixed in 0.2.3

Description

operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Recommendation Update to version 0.2.3 or later.

Related

Alias · CVE (1)

  • CVE-2016-10565 operadriver is a Opera Driver for Selenium. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References