En bref
- CVE-2019-20149 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant kind-of (kind-of project), kind-of.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.3%, plus élevée que 83.7% des vulnérabilités.
- Correctif : mettre à jour vers 6.0.3 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| kind-of | = 6.0.2
| No fix yet |
| kind-of npm | ≥ 6.0.0, < 6.0.3
| 6.0.3
|
Description
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
NVD description
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free