CVE-2016-10529

    Dashboard / Vulnerabilities / CVE-2016-10529

    CVE-2016-10529

    Published: 31 May 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.

    References: https://nodesecurity.io/advisories/91

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2fe5ca01cdc9be4b8d6469ebc99b95c64c210f5d

    Affected versions

    v3.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High