GitHub Advisoryadvisory · npm

GHSA-hw4r-xr38-hm8j Downloads Resources over HTTP in unicode-json

HIGH Published 2019-02-18 Modified 2021-01-08 Official page ↗
Aliases
CVE-2016-10610
Ecosystem
npm
Packages
unicode-json
Severity
High
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm unicode-json: < 2.0.0 → fixed in 2.0.0

Description

Affected versions of `unicode-json` insecurely downloads resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution. Recommendation Install version 2.0.0 or greater.

Related

Alias · CVE (1)

  • CVE-2016-10610 unicode-json is a unicode lookup table. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References