Description

ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.

Remediation

References

https://nodesecurity.io/advisories/279

Related Vulnerabilities

CVE-2021-21414 Vulnerability in npm package sdk

CVE-2019-15952 Vulnerability in npm package total.js

CVE-2019-10157 Vulnerability in npm package keycloak-connect

CVE-2020-2157 Vulnerability in maven package org.jenkins-ci.plugins:skytap

CVE-2019-13343 Vulnerability in maven package com.butor:portal

Severity

Critical

Classification

CWE-310 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory