Description

ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

Remediation

References

https://nodesecurity.io/advisories/184

Related Vulnerabilities

CVE-2018-1199 Vulnerability in maven package org.springframework.security:spring-security-config

CVE-2012-3451 Vulnerability in maven package org.apache.cxf:cxf-bundle-jaxrs

CVE-2018-1325 Vulnerability in maven package com.googlecode.wicket-jquery-ui:wicket-jquery-ui-plugins

CVE-2021-26291 Vulnerability in maven package org.apache.maven:apache-maven

CVE-2021-28100 Vulnerability in maven package com.netflix.priam:priam

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory CWE-310