« Volver al listado

CVE-2016-10564

Estado: ModificadaAlta (8.1)—

apk-parser es una herramienta para extraer información de Android Manifest de un archivo APK. apk-parser en versiones anteriores a la 0.1.6 descarga recursos de binarios mediante HTTP, volviéndose vulnerable a ataques Man-in-the-Middle (MitM). Es posible que se ejecute código de manera remota al cambiar el binario solicitado por un binario controlado por el atacante si el atacante se encuentra en la red o entre el usuario y el servidor remoto.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apk-parser Project — Apk-parser

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-10564",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "HackerOne",
          "product": "apk-parser node module",
          "versions": [
            {
              "status": "affected",
              "version": "<0.1.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-31T20:29:02.330",
  "references": [
    {
      "url": "https://nodesecurity.io/advisories/195",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://nodesecurity.io/advisories/195",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server."
    },
    {
      "lang": "es",
      "value": "apk-parser es una herramienta para extraer información de Android Manifest de un archivo APK. apk-parser en versiones anteriores a la 0.1.6 descarga recursos de binarios mediante HTTP, volviéndose vulnerable a ataques Man-in-the-Middle (MitM). Es posible que se ejecute código de manera remota al cambiar el binario solicitado por un binario controlado por el atacante si el atacante se encuentra en la red o entre el usuario y el servidor remoto."
    }
  ],
  "lastModified": "2026-06-17T00:39:56.650",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apk-parser_project:apk-parser:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B3368EC-DCB5-47F2-B180-544FD3511F84",
              "versionEndExcluding": "0.1.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}