GHSA-rh46-3fgc-mvrf

Source

https://github.com/advisories/GHSA-rh46-3fgc-mvrf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-rh46-3fgc-mvrf/GHSA-rh46-3fgc-mvrf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rh46-3fgc-mvrf

Aliases

CVE-2019-19507

Published

2019-12-04T21:25:28Z

Modified

2023-11-08T04:01:28.483830Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Validation bypass is possible in Json Pattern Validator

Details

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-12-04T19:47:26Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / jpv

Package

Name: jpv; View open source insights on deps.dev
Purl: pkg:npm/jpv

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-rh46-3fgc-mvrf/GHSA-rh46-3fgc-mvrf.json"