Vulnerability in HackerOne Engine.io-Client Node Module
CVE-2016-10536
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (61.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 61.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- HackerOne Engine.io-Client Node Module — versions <= 1.6.8
- Socket Engine.io-Client
Weakness classification (CWE)
References
- www.cigital.com/blog/node-js-socket-io/ (Third Party Advisory)
- github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7… (Patch, Third Party Advisory)
- nodesecurity.io/advisories/99 (Third Party Advisory)
Frequently asked questions
- What is CVE-2016-10536?
- CVE-2016-10536 is a medium-severity vulnerability in HackerOne Engine.io-Client Node Module, classified under Channel Accessible by Non-Endpoint. CVSS score: 5.9/10. Published 2018-05-31.
- How severe is CVE-2016-10536?
- Medium severity. CVSS v3 base score is 5.9 out of 10.