GitHub Advisoryadvisory · npm

GHSA-856x-cp3q-47vg Insecure Default Configuration in airbrake

MEDIUM Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10530
Ecosystem
npm
Packages
airbrake
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• npm airbrake: < 0.4.0 → fixed in 0.4.0

Description

Affected versions of `airbrake` default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information. Recommendation Update to version 0.4.0 or later, or upgrade from the now-deprecated `airbrake` module to its replacement, `airbrake-js`.

Related

Alias · CVE (1)

  • CVE-2016-10530 The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References