Improper Input Validation in Automattic Mongoose

緊急 9.1CVE-2019-17426 · GHSA-8687-vv9j-hgph · 10/10/2019 公開 · 17/06/2026 更新

要点

CVE-2019-17426 は mongoose (mongoosejs), mongoose に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.5%（全脆弱性の 74.2% より高い）。
対処：5.7.5, 4.13.21 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
mongoose mongoosejs	`≤ 5.7.4`	修正版なし
mongoose npm	`≥ 5.0.0, < 5.7.5< 4.13.21`	`5.7.54.13.21`

概要

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

NVD の説明

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).