CVE-2016-3956

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes…

published July 2, 2016

CVSS
—
EPSS
5%
Percentile
92.7
In the wild
Unconfirmed
What it is

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05456 · 92.7th percentile
Published
2016-07-02T14:00Z
EPSS history
Timeline
  • 02 JUL 14:00Z
    The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes…
    cvelistv5