Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR3bTUtcTd3di02angz

Downloads Resources over HTTP in bkjs-wand

Affected versions of bkjs-wand insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running bkjs-wand.

Recommendation

Update to version 0.3.2 or later.

Permalink: https://github.com/advisories/GHSA-4wm5-q7wv-6jx3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR3bTUtcTd3di02angz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 6 years ago
Updated: almost 2 years ago


EPSS Percentage: 0.00175
EPSS Percentile: 0.5554

Identifiers: GHSA-4wm5-q7wv-6jx3, CVE-2016-10571
References: Blast Radius: 0.0

Affected Packages

npm:bkjs-wand
Dependent packages: 2
Dependent repositories: 1
Downloads: 391 last month
Affected Version Ranges: < 0.3.2
Fixed in: 0.3.2
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.2.0, 0.2.2, 0.3.0
All unaffected versions: 0.3.2, 0.3.3, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.5.1, 0.5.2, 0.5.3