NVD

Id
19693  
Name
CVE-2016-3956  
Description
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-07-02  
Modified Date
2016-07-08  
Seq
2016-3956  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
107909 19693 CVE-2016-3956 http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability  View
107910 19693 CVE-2016-3956 http://www-01.ibm.com/support/docview.wss?uid=swg21980827  View
107911 19693 CVE-2016-3956 https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29  View
107912 19693 CVE-2016-3956 https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401  View
107913 19693 CVE-2016-3956 https://github.com/npm/npm/issues/8380  View
107914 19693 CVE-2016-3956 https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2719 JVNDB-2016-003492 Node.js で使用される npm の CLI における重要な情報を取得される脆弱性 Node.js で使用される npm の CLI は、任意のリクエストにベアラ (bearer) トークンを含めるため、重要な情報を取得される脆弱性が存在します。 CVE-2016-3956 90462 CVE-2016-3956 19693 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003492.html 2016-03-31 2016-07-12 View