Open-source package vulnerability · npm
CVE-2023-51837: Ylianst MeshCentral Missing SSL Certificate Validation
criticalCVSS 3.1 9.8GHSA-8xw6-9h78-c89j
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
Published Jan 30, 2024 · Updated Feb 5, 2024
Affected packages
meshcentral
- Ecosystem
- npm
- Affected
- <= 1.1.16
- Fixed in
- No patched version yet
- Check
npm ls meshcentral
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-51837
- https://github.com/Ylianst/MeshCentral/blob/master/mpsserver.js
- https://github.com/tianjk99/Cryptographic-Misuses/blob/main/Bug_MeshCentral.md
- https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51837.md
- https://github.com/advisories/GHSA-8xw6-9h78-c89j
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology