GitHub Advisoryadvisory · npm

GHSA-hc94-2wfr-4pwf appium-chromedriver downloads Resources over HTTP

HIGH Published 2019-02-18 Modified 2023-09-12 Official page ↗
Aliases
CVE-2016-10557
Ecosystem
npm
Packages
appium-chromedriver
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm appium-chromedriver: < 2.9.4 → fixed in 2.9.4

Description

Affected versions of `appium-chromedriver` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary. Recommendation Update to version 2.9.4 or later.

Related

Alias · CVE (1)

  • CVE-2016-10557 appium-chromedriver is a Node.js wrapper around Chromedriver. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References