CVE-2016-10567: Insecure Download of Executable in product-monitor
Summary
CVE-2016-10567: Downloads Resources over HTTP in product-monitor. Affects product-monitor versions < 2.2.5. Fixed in 2.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
product-monitor is an npm package that is used for monitoring and managing products. It provides functionality for downloading resources and executables. However, versions of product-monitor prior to 2.2.5 insecurely download an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability arises when an attacker with a privileged network position intercepts the response and replaces the downloaded executable with a malicious one. This can lead to code execution on the system running product-monitor, potentially compromising its security and integrity.
How To Fix
Minimum fixed version
2.2.5
This is the first release that contains the fix.
npm install product-monitor@2.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In summary, product-monitor versions prior to 2.2.5 are vulnerable to an insecure download of an executable. To mitigate this vulnerability, it is important to update to the recommended versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for product-monitor →
FAQ
product-monitor is an npm package used for monitoring and managing products.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running product-monitor.
You can fix this vulnerability by updating product-monitor to versions 2.2.5 or later.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database.
