CVE-2016-10538 Information

Description

The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary but it allows the starting user to overwrite any file they have access to.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Reference

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252 https://github.com/node-js-libs/cli/issues/81 https://nodesecurity.io/advisories/95

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

3.5