CVE-2016-10559

    Dashboard / Vulnerabilities / CVE-2016-10559

    CVE-2016-10559

    Published: 29 May 2018Last Modified: 24 Sept 2025

    Summary:

    Details: selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

    References: https://nodesecurity.io/advisories/164

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -004d345d0d13e212fa7e0edd3ff1782cf7498337

    Affected versions

    v1.0.0
    v1.0.1
    v1.0.2
    v1.0.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High