Vulnerabilities > CVE-2016-10692 - Cryptographic Issues vulnerability in Haxeshim Project Haxeshim

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

haxeshim-project

CWE-310

critical

NVD

Published: 2018-06-04

Updated: 2018-07-11

Summary

haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Vulnerable Configurations

Part	Description	Count
Application	Haxeshim_Project Haxeshim Project Haxeshim 0.0.1 Haxeshim Project Haxeshim 0.0.2 Haxeshim Project Haxeshim 0.0.3 Haxeshim Project Haxeshim 0.0.4 Haxeshim Project Haxeshim 0.0.5 Haxeshim Project Haxeshim 0.0.6 Haxeshim Project Haxeshim 0.0.7 Haxeshim Project Haxeshim 0.0.8 Haxeshim Project Haxeshim 0.1.0 Haxeshim Project Haxeshim 0.1.1 Haxeshim Project Haxeshim 0.1.2 Haxeshim Project Haxeshim 0.2.0 Haxeshim Project Haxeshim 0.3.0 Haxeshim Project Haxeshim 0.3.1 Haxeshim Project Haxeshim 0.3.2 Haxeshim Project Haxeshim 0.4.0 Haxeshim Project Haxeshim 0.5.0 Haxeshim Project Haxeshim 0.5.1 Haxeshim Project Haxeshim 0.5.2 Haxeshim Project Haxeshim 0.5.3 Haxeshim Project Haxeshim 0.5.4 Haxeshim Project Haxeshim 0.5.5 Haxeshim Project Haxeshim 0.5.6 Haxeshim Project Haxeshim 0.6.0 Haxeshim Project Haxeshim 0.6.1 Haxeshim Project Haxeshim 0.6.2 Haxeshim Project Haxeshim 0.6.3 Haxeshim Project Haxeshim 0.7.0 Haxeshim Project Haxeshim 0.7.1 Haxeshim Project Haxeshim 0.7.2 Haxeshim Project Haxeshim 0.8.0 Haxeshim Project Haxeshim 0.8.1 Haxeshim Project Haxeshim 0.8.2 Haxeshim Project Haxeshim 0.8.3 Haxeshim Project Haxeshim 0.8.4 Haxeshim Project Haxeshim 0.8.5 Haxeshim Project Haxeshim 0.8.6 Haxeshim Project Haxeshim 0.8.7 Haxeshim Project Haxeshim 0.8.8 Haxeshim Project Haxeshim 0.8.9 Haxeshim Project Haxeshim 0.9.0 Haxeshim Project Haxeshim 0.9.1 Haxeshim Project Haxeshim 0.9.2 Haxeshim Project Haxeshim 0.10.0 Haxeshim Project Haxeshim 0.11.0 Haxeshim Project Haxeshim 0.12.0 Haxeshim Project Haxeshim 0.12.1 Haxeshim Project Haxeshim 0.12.2 Haxeshim Project Haxeshim 0.12.3 Haxeshim Project Haxeshim 0.12.4	50

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

References

https://nodesecurity.io/advisories/300