CVE-2016-10680 Downloads Resources over HTTP in adamvr-geoip-lite
Attackers can intercept GeoIP data downloads via HTTP, altering application decisions or causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10680?
CVE-2016-10680 is a high-severity vulnerability in HackerOne adamvr-geoip-lite node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which leaves it vulnerable to MITM attacks. This impacts the integrity and availability of this geoip data that may alter the decisions made by an application using this data.
Which versions are affected by CVE-2016-10680?
2 open source packages ship an affected version, including adamvr-geoip-lite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
adamvr-geoip-lite npm | From 0.0.0 | None |
adamvr-geoip-lite npm | From 0.0.0 | None |
Products include Adamvr-Geoip-Lite Project Adamvr-Geoip-Lite.
How do I fix CVE-2016-10680?
No fix has been published for CVE-2016-10680 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10680 being exploited?
There is no known exploitation of CVE-2016-10680 in the wild and no public exploit code.
Sources
Also known as GHSA-h2jv-5v3f-7m7j.