Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-3956

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

Published

2016-07-02T14:59:19.417

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application ibm sdk ≤ 1.1.0.20 Yes
Application ibm sdk ≤ 1.2.0.10 Yes
Application ibm sdk ≤ 4.4.1.0 Yes
Application nodejs node.js 0.10.0 Yes
Application nodejs node.js 0.10.1 Yes
Application nodejs node.js 0.10.2 Yes
Application nodejs node.js 0.10.3 Yes
Application nodejs node.js 0.10.4 Yes
Application nodejs node.js 0.10.5 Yes
Application nodejs node.js 0.10.6 Yes
Application nodejs node.js 0.10.7 Yes
Application nodejs node.js 0.10.8 Yes
Application nodejs node.js 0.10.9 Yes
Application nodejs node.js 0.10.10 Yes
Application nodejs node.js 0.10.11 Yes
Application nodejs node.js 0.10.12 Yes
Application nodejs node.js 0.10.13 Yes
Application nodejs node.js 0.10.14 Yes
Application nodejs node.js 0.10.15 Yes
Application nodejs node.js 0.10.16 Yes
Application nodejs node.js 0.10.16-isaacs-manual Yes
Application nodejs node.js 0.10.17 Yes
Application nodejs node.js 0.10.18 Yes
Application nodejs node.js 0.10.19 Yes
Application nodejs node.js 0.10.20 Yes
Application nodejs node.js 0.10.21 Yes
Application nodejs node.js 0.10.22 Yes
Application nodejs node.js 0.10.23 Yes
Application nodejs node.js 0.10.24 Yes
Application nodejs node.js 0.10.25 Yes
Application nodejs node.js 0.10.26 Yes
Application nodejs node.js 0.10.27 Yes
Application nodejs node.js 0.10.28 Yes
Application nodejs node.js 0.10.29 Yes
Application nodejs node.js 0.10.30 Yes
Application nodejs node.js 0.10.31 Yes
Application nodejs node.js 0.10.32 Yes
Application nodejs node.js 0.10.33 Yes
Application nodejs node.js 0.10.34 Yes
Application nodejs node.js 0.10.35 Yes
Application nodejs node.js 0.10.36 Yes
Application nodejs node.js 0.10.37 Yes
Application nodejs node.js 0.10.38 Yes
Application nodejs node.js 0.10.39 Yes
Application nodejs node.js 0.10.40 Yes
Application nodejs node.js 0.10.41 Yes
Application nodejs node.js 0.12.0 Yes
Application nodejs node.js 0.12.1 Yes
Application nodejs node.js 0.12.2 Yes
Application nodejs node.js 0.12.3 Yes
Application nodejs node.js 0.12.4 Yes
Application nodejs node.js 0.12.5 Yes
Application nodejs node.js 0.12.6 Yes
Application nodejs node.js 0.12.7 Yes
Application nodejs node.js 0.12.8 Yes
Application nodejs node.js 0.12.9 Yes
Application nodejs node.js 4.0.0 Yes
Application nodejs node.js 4.1.0 Yes
Application nodejs node.js 4.1.1 Yes
Application nodejs node.js 4.1.2 Yes
Application nodejs node.js 4.2.0 Yes
Application nodejs node.js 4.2.1 Yes
Application nodejs node.js 4.2.2 Yes
Application nodejs node.js 4.2.3 Yes
Application nodejs node.js 4.2.4 Yes
Application nodejs node.js 4.2.5 Yes
Application nodejs node.js 4.2.6 Yes
Application nodejs node.js 4.3.0 Yes
Application nodejs node.js 4.3.1 Yes
Application nodejs node.js 4.3.1 Yes
Application nodejs node.js 4.3.1 Yes
Application nodejs node.js 4.3.2 Yes
Application nodejs node.js 4.4.0 Yes
Application nodejs node.js 4.4.0 Yes
Application nodejs node.js 4.4.0 Yes
Application nodejs node.js 4.4.0 Yes
Application nodejs node.js 4.4.0 Yes
Application nodejs node.js 4.4.1 Yes
Application nodejs node.js 5.0.0 Yes
Application nodejs node.js 5.1.0 Yes
Application nodejs node.js 5.1.1 Yes
Application nodejs node.js 5.2.0 Yes
Application nodejs node.js 5.3.0 Yes
Application nodejs node.js 5.4.0 Yes
Application nodejs node.js 5.4.1 Yes
Application nodejs node.js 5.5.0 Yes
Application nodejs node.js 5.6.0 Yes
Application nodejs node.js 5.7.0 Yes
Application nodejs node.js 5.7.1 Yes
Application nodejs node.js 5.8.0 Yes
Application nodejs node.js 5.8.1 Yes
Application nodejs node.js 5.9.0 Yes
Application nodejs node.js 5.9.1 Yes
Application npmjs npm < 2.15.1 Yes
Application npmjs npm < 3.8.3 Yes
References