CVE-2016-10530
Insecure Default Configuration in airbrake
EPSS 0.30%
描述
Affected versions of `airbrake` default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information. ## Recommendation Update to version 0.4.0 or later, or upgrade from the now-deprecated `airbrake` module to its replacement, [`airbrake-js`](https://www.npmjs.com/package/airbrake-js).
如何修補 CVE-2016-10530
要修補 CVE-2016-10530,請將受影響套件升級到下列已修補版本。
- —升級至 0.4.0 或更新版本
CVE-2016-10530 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 0.4.0