In breve
- CVE-2019-20149 è una vulnerabilità ALTO (CVSS 7.5) che riguarda kind-of (kind-of project), kind-of.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.3%, superiore al 83.7% delle vulnerabilità.
- Correzione: aggiornare a 6.0.3 o successiva.
| Package | Affected versions | Patched versions |
|---|
| kind-of | = 6.0.2
| No fix yet |
| kind-of npm | ≥ 6.0.0, < 6.0.3
| 6.0.3
|
Description
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
NVD description
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free