CVE-2017-16003

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.28%

Published

May 29, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Weaknesses (CWE)

CWE-311CWE-311

Affected Products (1)

windows-build-tools_project · windows-build-tools (up to 1.0.0)vulnerable

References (4)

https://github.com/felixrieseberg/windows-build-tools/commit/9835d33e68f2cb5e4d148e954bb3ed0221d98e90

PatchThird Party Advisory

https://nodesecurity.io/advisories/304

Third Party Advisory

https://github.com/felixrieseberg/windows-build-tools/commit/9835d33e68f2cb5e4d148e954bb3ed0221d98e90

PatchThird Party Advisory

https://nodesecurity.io/advisories/304

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs