{"id":"GHSA-hc94-2wfr-4pwf","summary":"appium-chromedriver downloads Resources over HTTP","details":"Affected versions of `appium-chromedriver` insecurely download resources over HTTP. \n\nIn scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary.\n\n\n## Recommendation\n\nUpdate to version 2.9.4 or later.","aliases":["CVE-2016-10557"],"modified":"2023-11-08T03:58:12.448933Z","published":"2019-02-18T23:40:19Z","database_specific":{"cwe_ids":["CWE-311"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:39:54Z","nvd_published_at":null},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10557"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hc94-2wfr-4pwf"},{"type":"WEB","url":"https://www.npmjs.com/advisories/162"}],"affected":[{"package":{"name":"appium-chromedriver","ecosystem":"npm","purl":"pkg:npm/appium-chromedriver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-hc94-2wfr-4pwf/GHSA-hc94-2wfr-4pwf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}