CVE-2016-10673 json
ipip-coffee downloads Resources over HTTP
published 2018-06-04 8 y ago modified 2026-06-17 4 mo ago also GHSA-m8pw-h8qj-rgj9 , EUVD-2019-0314
- cvss
- 8.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ipip-coffee | <=1.0.9 |
no fix listed |
Affected products
- HackerOne ipip-coffee node module
Classification
References
-
nodesecurity.io
/advisories/279
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2016-10673
advisory
-
github.com
/advisories/GHSA-m8pw-h8qj-rgj9
advisory
-
npmjs.com
/advisories/279
web
Sources
- CVE List CVE-2016-10673
- GitHub Advisory GHSA-m8pw-h8qj-rgj9
- NVD CVE-2016-10673
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.