CVE-2016-10532

    Dashboard / Vulnerabilities / CVE-2016-10532

    CVE-2016-10532

    Published: 31 May 2018Last Modified: 8 Jul 2026

    Summary:

    Details: console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.

    References: https://nodesecurity.io/advisories/90

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v2.2.13
    v2.2.12
    v2.2.11
    v2.2.10
    v2.2.9
    v2.2.8
    v2.2.7
    v2.2.6
    v2.2.5
    v2.2.4
    v2.2.3
    v2.2.2
    v2.2.1
    v2.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-10532 | CVE-DB