CVE-2016-10660: Insecure Download of Resources in fis-parser-sass-bin
Summary
CVE-2016-10660: Downloads Resources over HTTP in fis-parser-sass-bin. Affects fis-parser-sass-bin versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fis-parser-sass-bin is an npm package used for parsing Sass files in the FIS (Fis3) framework. It allows developers to compile Sass code into CSS. This package is vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of fis-parser-sass-bin insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running fis-parser-sass-bin.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in fis-parser-sass-bin allows for an insecure download of resources, which can be exploited by attackers to execute malicious code. It is recommended to avoid using this package and uninstall it if already installed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fis-parser-sass-bin →
FAQ
fis-parser-sass-bin is an npm package used for parsing Sass files in the FIS (Fis3) framework. It allows developers to compile Sass code into CSS.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running fis-parser-sass-bin.
No, there is currently no patch available for this vulnerability.
To mitigate the risk, it is recommended to avoid using this package and uninstall it if already installed. Additionally, ensure that the package is not installed while connected to a public network.
The vulnerability can be exploited by attackers with a privileged network position, such as those who have compromised your network or have privileged access to your ISP.
