En bref
- CVE-2019-19507 est une vulnérabilité MOYENNE (CVSS 5.3) touchant json pattern validator (json pattern validator project), jpv.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.97%, plus élevée que 62.2% des vulnérabilités.
- Correctif : mettre à jour vers 2.1.1 ou plus récent.
Description
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
NVD description
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Autres vulnérabilités de json pattern validator
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free