Man-in-the-middle attack in unicode - CVE-2016-10578
Published: June 1, 2018 / Updated: June 5, 2018
Vulnerability identifier: #VU13178
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10578
CWE-ID: CWE-300
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent unauthenticated attacker to conduct man-in-the-middle attack on the target system.
The vulnerability exists in the npm, Inc. unicode module due to improper security restrictions. An adjacent attacker can conduct man-in-the-middle attack, intercept of the communication channel between the affected app and modify or read resources from the system, or possibly execute arbitrary code.
Affected software
unicode
How to mitigate CVE-2016-10578
Install update from vendor's website.