google-closure-tools-latest における暗号に関する脆弱性
| Title |
google-closure-tools-latest における暗号に関する脆弱性
|
| Summary |
google-closure-tools-latest には、暗号に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
Jan. 1, 2017, midnight |
| Registration Date |
July 31, 2018, 4:07 p.m. |
| Last Update |
July 31, 2018, 4:07 p.m. |
|
CVSS3.0 : 重要
|
| Score |
8.1
|
| Vector |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
CVSS2.0 : 危険
|
| Score |
9.3
|
| Vector |
AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected System
| google-closure-tools-latest project |
|
google-closure-tools-latest
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2018年07月31日]
掲載 |
July 31, 2018, 4:07 p.m. |
NVD Vulnerability Information
CVE-2016-10677
| Summary |
google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
|
| Publication Date |
June 5, 2018, 1:29 a.m. |
| Registration Date |
Jan. 26, 2021, 2:06 p.m. |
| Last Update |
Nov. 21, 2024, 11:44 a.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:google-closure-tools-latest_project:google-closure-tools-latest:*:*:*:*:*:node.js:*:* |
|
0.1.1 |
|
|
Related information, measures and tools
Common Vulnerabilities List