GitHub Advisoryadvisory · npm

GHSA-8687-vv9j-hgph Improper Input Validation in Automattic Mongoose

CRITICAL Published 2019-10-22 Modified 2023-11-29 Official page ↗
Aliases
CVE-2019-17426
Ecosystem
npm
Packages
mongoose
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2019-10-14

Affected packages

• npm mongoose: >= 5.0.0, < 5.7.5 → fixed in 5.7.5 • npm mongoose: < 4.13.21 → fixed in 4.13.21

Description

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a `_bsontype` attribute is ignored. For example, adding `"_bsontype":"a"` can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Related

Alias · CVE (1)

  • CVE-2019-17426 Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References