haxefoundation/npm-haxe · Security
Downloads Resources over HTTP in haxe
- GHSA ID
- GHSA-g785-775g-f2g8
- CVE ID
- CVE-2016-10602
- Severity
- high
- Published
- Updated
Description
Affected versions of haxe insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running haxe.
Recommendation
Update to version 5.0.10 or later.
CWEs
- CWE-269 · Improper Privilege Management
- CWE-311 · Missing Encryption of Sensitive Data