CVE-2019-10805
Exposure of Resource to Wrong Sphere in valib
概要
Exposure of Resource to Wrong Sphere in valib
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
npm
valib
[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.0.0"}]}]
参照URL
- advisory nvd.nist.gov
- web snyk.io
- web npmjs.com