CVE-2017-16126: Tracking Module in botbait
5.3
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.46044%
CWE
Published
9/1/2020
Updated
2/6/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
botbait | npm | >= 0.0.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
While exact function names/paths aren't disclosed in available resources, the vulnerability fundamentally exists in two core behaviors: 1) Accessing Node.js runtime properties (process.versions, process.platform) to collect system information 2) Network operations to gather source IP and transmit collected data. These operations inherently require functions interacting with process object and network APIs, making their implementing functions vulnerable by design. High confidence stems from the explicit data elements listed in the advisory matching standard Node.js environment properties and network tracking patterns.