8.1high
CVE-2016-10673
ipip-coffee downloads Resources over HTTP
Also known as GHSA-m8pw-h8qj-rgj9
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 45%
Public exploits
0
none known
Summary
ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.
Exploit prediction (EPSS)
0.54% probability of exploitation in the next 30 days, higher than 45% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ipip-coffee | <=1.0.9 | no fix listed |
Affected products
- HackerOne ipip-coffee node module
Classification
References
- nodesecurity.io /advisories/279 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-10673 · advisory
- github.com /advisories/GHSA-m8pw-h8qj-rgj9 · advisory
- npmjs.com /advisories/279 · web
Sources
- CVE List: CVE-2016-10673
- GitHub Advisory: GHSA-m8pw-h8qj-rgj9
- NVD: CVE-2016-10673
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.