GitHub Advisoryadvisory · npm

GHSA-p788-rj37-357w Insecure Defaults Leads to Potential MITM in ezseed-transmission

MEDIUM Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2016-1000224
Ecosystem
npm
Packages
ezseed-transmission
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295, CWE-300
Reviewed
2020-08-31

Affected packages

• npm ezseed-transmission: >= 0.0.10, < 0.0.15 → fixed in 0.0.15

Description

Affected versions of `ezseed-transmission` download and run a script over an HTTP connection. An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`. Recommendation Update to version 0.0.15 or later.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-300 Channel Accessible by Non-Endpoint weakness

References