GitHub Advisoryadvisory · npm

GHSA-q52j-4q2q-hcj6 Authentication Bypass in console-io

CRITICAL Published 2019-02-18 Modified 2021-09-16 Official page ↗
Aliases
CVE-2016-10532
Ecosystem
npm
Packages
console-io
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2020-06-16

Affected packages

• npm console-io: < 2.3.0 → fixed in 2.3.0

Description

Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution. Recommendation Update to version 2.3.0 or later.

Related

Alias · CVE (1)

  • CVE-2016-10532 console-io is a module that allows users to implement a web console in their application. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References