rse/node-prince · Security
Downloads Resources over HTTP in prince
- GHSA ID
- GHSA-cr79-9pwf-r6f5
- CVE ID
- CVE-2016-10591
- Severity
- high
- Published
- Updated
Description
Affected versions of prince insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running prince.
Recommendation
Update to version 1.4.6 or later.
CWEs
- CWE-269 · Improper Privilege Management
- CWE-311 · Missing Encryption of Sensitive Data