GitHub Advisoryadvisory · npm

GHSA-q8xg-8xwf-m598 Machine-In-The-Middle in lix

HIGH Published 2020-04-16 Modified 2021-09-16 Official page ↗
Aliases
CVE-2020-10800
Ecosystem
npm
Packages
lix
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-544, CWE-639
Reviewed
2020-04-16

Affected packages

• npm lix: <= 15.11.4 (no fix yet)

Description

All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2020-10800 lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the… vulnerability

Weakness · CWE (2)

  • CWE-544 Missing Standardized Error Handling Mechanism weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References