Environment Variable Hijacking in Node-OpenCV by NPM
CVE-2017-16067

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Node-opencv Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2017-16067?

A vulnerability was identified in the Node-OpenCV module, which was published on NPM with malicious intent to hijack environment variables. This concern led to its removal from the NPM registry to protect users from potential exploitation.

Affected Version(s)

node-opencv node module All versions

References

https://nodesecurity.io/advisories/506
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.