In short
- CVE-2016-10530 is a MEDIUM (CVSS 5.9) vulnerability affecting airbrake (airbrake), airbrake.
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.2% of all vulnerabilities.
- Fix: update to 0.4.0 or later.
| Package | Affected versions | Patched versions |
|---|
| airbrake | ≤ 0.3.8
| No fix yet |
| airbrake npm | < 0.4.0
| 0.4.0
|
Description
Affected versions of airbrake default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information.
Recommendation
Update to version 0.4.0 or later, or upgrade from the now-deprecated airbrake module to its replacement, airbrake-js.
NVD description
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free