Vulnerability in HackerOne Herbivore Node Module
CVE-2016-10665
herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.022 (81.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000
Affected products
- HackerOne Herbivore Node Module — versions All versions
- Herbivore Project
Weakness classification (CWE)
References
- github.com/samatt/Herbivore/commit/0a041defc3463e99948e5d2064aef54b2128c5a3 (Broken Link)
- nodesecurity.io/advisories/258 (Third Party Advisory)
Frequently asked questions
- What is CVE-2016-10665?
- CVE-2016-10665 is a high-severity vulnerability in HackerOne Herbivore Node Module, classified under Missing Encryption of Sensitive Data. CVSS score: 8.1/10. Published 2018-06-04.
- How severe is CVE-2016-10665?
- High severity. CVSS v3 base score is 8.1 out of 10.