CVE-2016-10538 PUBLISHED

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

EPSS 0.32% · 54.6th percentile

Risk Scores

EPSS Score
0.32%
54.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSnode-cli0, 0.4.4~20120516-1
Ubuntu:18.04:LTSnode-cli0, 0.4.4~20120516-1

Timeline

References

Open in Interactive Console →