CVE-2016-10673

HIGH

ipip-coffee < 1.0.9 - Man-in-the-Middle via HTTP Resource Download

Title source: llm
STIX 2.1

Description

ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://nodesecurity.io/advisories/279

Scores

CVSS v3 8.1
EPSS 0.0055
EPSS Percentile 41.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-310 CWE-311
Status published
Products (2)
ipip/ipip-coffee < 1.0.9
npm/ipip-coffee 0npm
Published Jun 04, 2018
Tracked Since Feb 18, 2026