GitHub Advisoryadvisory · npm
GHSA-mq7g-6rv4-pj95 Downloads Resources over HTTP in embedza
HIGH
Official page ↗
- Aliases
- CVE-2016-10569
- Ecosystem
- npm
- Packages
- embedza
- Severity
- High
- Weaknesses
- CWE-311
- Reviewed
- 2020-06-16
Affected packages
• npm embedza: < 1.2.4 → fixed in 1.2.4
Description
Affected versions of `embedza` insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `embedza`.
Recommendation
Update to version 1.2.4 or later.
Related
Alias · CVE (1)
- CVE-2016-10569 embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. vulnerability
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness