7.5

CVE-2016-3956: ibm sdk

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2016-3956USN-4785-1DEBIAN-CVE-2016-3956
Published 02-07-2016Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2016-3956 is a high (CVSS 7.5) vulnerability in ibm sdk. EPSS estimates a 5.46% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
5.46%
0%100%
Low · -1.29 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Duplicates 1 · Related 9
CVE-2016-1000014CGA-23VM-87QJ-2R94CGA-4QF6-H3F5-P5H9CGA-4WRW-MMW5-FWMQCGA-8HX3-XW3H-5F4MCGA-9M4W-3MQ6-F9P6

Timeline

  1. 02-07-2016
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

5.46%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

-1.29 pp

From 6.75% on 18-09-2026

18-09-202618-10-2026
EPSS score
5.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard72 products
  • code-serverAll versions (No fix recorded)
  • code-server-compatAll versions (No fix recorded)
  • commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
  • commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
  • commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)
Wolfi2 products
  • code-serverAll versions (No fix recorded)
  • code-server-compatAll versions (No fix recorded)
Debian1 product
  • npm< 5.8.0+ds-2
Ibm1 product
  • sdk≤ 1.1.0.20 | ≤ 1.2.0.10 | ≤ 4.4.1.0
Nodejs1 product
  • node.jsEOL0.10.0 | 0.10.1 | 0.10.2 | 0.10.3 | 0.10.4 | 0.10.5 | 0.10.6 | 0.10.7 | 0.10.8 | 0.10.9 | 0.10.10 | 0.10.11 | 0.10.12 | 0.10.13 | 0.10.14 | 0.10.15 | 0.10.16 | 0.10.16-isaacs-manual | 0.10.17 | 0.10.18 | 0.10.19 | 0.10.20 | 0.10.21 | 0.10.22 | 0.10.23 | 0.10.24 | 0.10.25 | 0.10.26 | 0.10.27 | 0.10.28 | 0.10.29 | 0.10.30 | 0.10.31 | 0.10.32 | 0.10.33 | 0.10.34 | 0.10.35 | 0.10.36 | 0.10.37 | 0.10.38 | 0.10.39 | 0.10.40 | 0.10.41 | 0.12.0 | 0.12.1 | 0.12.2 | 0.12.3 | 0.12.4 | 0.12.5 | 0.12.6 | 0.12.7 | 0.12.8 | 0.12.9 | 4.0.0 | 4.1.0 | 4.1.1 | 4.1.2 | 4.2.0 | 4.2.1 | 4.2.2 | 4.2.3 | 4.2.4 | 4.2.5 | 4.2.6 | 4.3.0 | 4.3.1 | 4.3.1:rc.1 | 4.3.1:rc.2 | 4.3.2 | 4.4.0 | 4.4.0:rc.1 | 4.4.0:rc.2 | 4.4.0:rc.3 | 4.4.0:rc.4 | 4.4.1 | 5.0.0 | 5.1.0 | 5.1.1 | 5.2.0 | 5.3.0 | 5.4.0 | 5.4.1 | 5.5.0 | 5.6.0 | 5.7.0 | 5.7.1 | 5.8.0 | 5.8.1:rc.1 | 5.9.0 | 5.9.1
Npm1 product
  • npm< 2.15.1 | ≥ 3.0.0, < 3.8.3
Npmjs1 product
  • npm< 2.15.1 | ≥ 3.0.0, < 3.8.3
Ubuntu1 product
  • npm< 3.5.2-0ubuntu4.1.16.04.1~esm1 | < 3.5.2-0ubuntu4.1.18.04.1~esm1

8 vendors · 80 products

References

14 links
Show all 14 references