CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-16035
The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-319, CWE-311
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hubspot:hubl-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h8mc-42c3-r72p | npm | hubl-server | <=1.1.5 | no fix published |