Publish GHSA-7p6h-3fmw-539q

advisories/github-reviewed/2019/02/GHSA-7p6h-3fmw-539q/GHSA-7p6h-3fmw-539q.json

@@ -1,15 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7p6h-3fmw-539q",
-  "modified": "2021-01-08T21:16:45Z",
+  "modified": "2023-09-11T18:11:23Z",
   "published": "2019-02-18T23:47:27Z",
   "aliases": [
     "CVE-2016-10624"
   ],
-  "summary": "Downloads Resources over HTTP in selenium-chromedriver",
+  "summary": "selenium-chromedriver Downloads Resources over HTTP",
   "details": "Affected versions of `selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-chromedriver`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability, and the author has marked the package as deprecated.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {
@@ -17,6 +20,11 @@
         "ecosystem": "npm",
         "name": "selenium-chromedriver"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",