CVE-2016-10530

Published: May 31, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.

Affected (1)

Products: Airbrake: Airbrake

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Airbrake Airbrake	Up to 0.3.8

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/airbrake/node-airbrake/issues/70

Source: support@hackerone.com

Broken LinkThird Party Advisory

https://nodesecurity.io/advisories/96

Source: support@hackerone.com

Third Party Advisory

https://github.com/airbrake/node-airbrake/issues/70

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party Advisory

https://nodesecurity.io/advisories/96

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.