CVE-2016-10529

Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://nodesecurity.io/advisories/91	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:droppy_project:droppy:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2018-05-31 20:29

Updated : 2024-02-28 16:25

NVD link : CVE-2016-10529

Mitre link : CVE-2016-10529

CVE.ORG link : CVE-2016-10529

JSON object : View

Products Affected

droppy_project

droppy

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2016-10529", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-05-31T20:29:00.940", "references": [{"url": "https://nodesecurity.io/advisories/91", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others."}, {"lang": "es", "value": "Droppy en versiones anteriores a la 3.5.0 no realiza ning\u00fan tipo de verificaci\u00f3n para peticiones websocket Cross-Domain. Un atacante puede hacer una p\u00e1gina especialmente manipulada que puede enviar peticiones como el contexto del usuario que tiene la sesi\u00f3n iniciada actualmente. Por ejemplo, esto significa que el usuario malicioso podr\u00eda a\u00f1adir una nueva cuenta de administrador bajo su control, adem\u00e1s de eliminar otras."}], "lastModified": "2019-10-09T23:16:43.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:droppy_project:droppy:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1629CFF8-A569-48DE-B499-8064F26B4A6D", "versionEndExcluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}