// For flags

CVE-2016-10532

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.

console-io es un módulo que permite que los usuarios implementen una consola web en su aplicación. Un usuario malicioso podría omitir la autenticación y ejecutar cualquier comando que el usuario que está ejecutando la aplicación console-io en versiones 2.2.13 y anteriores pueda ejecutar. Esto significa que, si console-io se ejecuta desde root, el atacante tendría acceso total al sistema. Esta vulnerabilidad existe debido a que la aplicación console-io no configura socket.io para que requiera autenticación, lo que permite que un usuario malicioso se conecte mediante un websocket para enviar comandos y recibir la respuesta.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-10-29 CVE Reserved
  • 2018-05-31 CVE Published
  • 2024-09-16 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
References (1)
URL Tag Source
https://nodesecurity.io/advisories/90 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Console-io Project
Search vendor "Console-io Project"
 Console-io
Search vendor "Console-io Project" for product "Console-io"
 <= 2.2.13
Search vendor "Console-io Project" for product "Console-io" and version " <= 2.2.13"
node.js
Affected