CVE-2019-10781

Опубликовано: 22 янв. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize() and the validate() function used within schema-inspector.

Ссылки

https://github.com/Atinux/schema-inspector/commit/345a7b2eed11bb6128421150d65f4f83fdbb737d
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SCHEMAINSPECTOR-536970
Third Party Advisory
https://github.com/Atinux/schema-inspector/commit/345a7b2eed11bb6128421150d65f4f83fdbb737d
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SCHEMAINSPECTOR-536970
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:schema-inspector_project:schema-inspector:*:*:*:*:*:*:*:*

Версия до 1.6.9 (исключая)

EPSS

Процентиль: 36%

0.0015

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-668

Связанные уязвимости

GHSA-r24h-634p-m72x