Machine-In-The-Middle in airtable

Description

Affected versions of airtable are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged network position to decrypt intercepted traffic.

Recommendation

Update the airtable package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.1.19, < 0.7.2
• Patched version(s): 0.7.2

References

• GHSA-jrj9-5qp6-2v8q
• www.npmjs.com

Related Issues

• Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE - Vulnerability
• @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability
• @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
• @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

airtable