CVE-2016-10641 Downloads Resources over HTTP in node-bsdiff-android

HighCVSS 8.1 EPSS 0.57%

Description

node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

Product	Affected versions	Fixed in
npm node-bsdiff-android(npm)	<= 0.1.5	No fix listed
node-bsdiff-android project node-bsdiff-android	<= 0.1.5	No fix listed
HackerOne node-bsdiff-android node module	= All versions	No fix listed

8.1 High

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (2)

EPSS (exploitation probability, 30 days): 0.57% (percentile 47.6)
CWE: CWE-269 Improper Privilege Management CWE-310 CWE-311 Missing Encryption of Sensitive Data

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.