요약
- CVE-2019-20149은(는) kind-of (kind-of project), kind-of에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 2.3%, 전체 취약점의 83.7%보다 높음.
- 조치: 6.0.3 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| kind-of | = 6.0.2
| No fix yet |
| kind-of npm | ≥ 6.0.0, < 6.0.3
| 6.0.3
|
Description
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Recommendation
Upgrade to versions 6.0.3 or later.
NVD description
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free