CVE-2016-10667: Critical severity selenium vulnerability
selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10667?
CVE-2016-10667 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-10667?
To fix CVE-2016-10667, ensure that your selenium-portal installation is updated to a version that does not download resources over HTTP.
What are the potential impacts of CVE-2016-10667?
The potential impacts of CVE-2016-10667 include unauthorized remote code execution and increased risk of man-in-the-middle attacks.
Which versions of selenium-portal are affected by CVE-2016-10667?
CVE-2016-10667 affects all versions of selenium-portal up to and including 0.0.1-2.
How can I mitigate the risk of CVE-2016-10667?
Mitigate the risk of CVE-2016-10667 by configuring selenium-portal to use HTTPS for downloading resources.