GHSA-h2jv-5v3f-7m7j

    Dashboard / Vulnerabilities / GHSA-h2jv-5v3f-7m7j

    GHSA-h2jv-5v3f-7m7j

    Published: 1 Sept 2020Last Modified: 8 Nov 2023

    Summary: Downloads Resources over HTTP in adamvr-geoip-lite

    Details: Affected versions of `adamvr-geoip-lite` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application. ## Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different package if available. Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-10680, https://www.npmjs.com/advisories/283

    Affected packages

    Package

    Name: adamvr-geoip-lite

    Purl: pkg:npm/adamvr-geoip-lite

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h2jv-5v3f-7m7j | CVE-DB