CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-10568
High (8.1) in geoip-lite-country project geoip-lite-country. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in geoip-lite-country 1.1.4.
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-310, CWE-311
- Published
- Modified
- Record from
- the NVD, synced
Affected
- geoip-lite-country_project:geoip-lite-country
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ff29-f57w-2mm3 | npm | geoip-lite-country | <1.1.4 | 1.1.4 |