mongoose-4.2.4.tgz: 10 vulnerabilities (highest severity is: 9.8) #15
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-bolt-for-github
bot
added
the
Mend: dependency security vulnerability
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.2.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Vulnerabilities
Details
Vulnerable Library - mongoose-4.2.4.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.2.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Publish Date: 2022-07-28
URL: CVE-2022-2564
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2564
Release Date: 2022-07-28
Fix Resolution: 5.13.15
Step up your Open Source Security Game with Mend here
Vulnerable Library - mpath-0.1.1.tgz
{G,S}et object values using MongoDB path notation
Library home page: https://registry.npmjs.org/mpath/-/mpath-0.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mpath/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Publish Date: 2021-09-01
URL: CVE-2021-23438
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23438
Release Date: 2021-09-01
Fix Resolution (mpath): 0.8.4
Direct dependency fix Resolution (mongoose): 5.13.9
Step up your Open Source Security Game with Mend here
Vulnerable Library - bson-0.4.23.tgz
A bson parser for node.js and the browser
Library home page: https://registry.npmjs.org/bson/-/bson-0.4.23.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/bson/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Publish Date: 2020-03-30
URL: CVE-2020-7610
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-04-01
Fix Resolution (bson): 1.1.4
Direct dependency fix Resolution (mongoose): 5.3.9
Step up your Open Source Security Game with Mend here
Vulnerable Library - mongoose-4.2.4.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.2.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Publish Date: 2019-10-10
URL: CVE-2019-17426
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17426
Release Date: 2019-10-10
Fix Resolution: 4.13.20
Step up your Open Source Security Game with Mend here
Vulnerable Library - kerberos-0.0.24.tgz
Kerberos library for Node.js
Library home page: https://registry.npmjs.org/kerberos/-/kerberos-0.0.24.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/kerberos/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Publish Date: 2020-05-16
URL: CVE-2020-13110
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1514
Release Date: 2020-05-20
Fix Resolution (kerberos): 1.0.0
Direct dependency fix Resolution (mongoose): 4.2.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - mongoose-4.2.4.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.2.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
There is a potential memory disclosure and DoS vulnerability in mongoose from 3.5.5 before 3.8.36 and from 4.0.0 before 4.3.6.
Publish Date: 2016-01-15
URL: WS-2016-0026
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2016-01-15
Fix Resolution: 4.3.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - mpath-0.1.1.tgz
{G,S}et object values using MongoDB path notation
Library home page: https://registry.npmjs.org/mpath/-/mpath-0.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mpath/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
Mend Note: Converted from WS-2018-0224, on 2022-11-08.
Publish Date: 2019-02-01
URL: CVE-2018-16490
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://hackerone.com/reports/390860
Release Date: 2019-02-01
Fix Resolution (mpath): 0.5.1
Direct dependency fix Resolution (mongoose): 4.13.17
Step up your Open Source Security Game with Mend here
Vulnerable Library - mongoose-4.2.4.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.2.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Publish Date: 2016-01-15
URL: WS-2018-0077
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2016-01-15
Fix Resolution: 4.3.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - bson-0.4.23.tgz
A bson parser for node.js and the browser
Library home page: https://registry.npmjs.org/bson/-/bson-0.4.23.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/bson/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Publish Date: 2020-03-31
URL: CVE-2019-2391
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2391
Release Date: 2020-09-29
Fix Resolution (bson): 1.1.4
Direct dependency fix Resolution (mongoose): 5.3.9
Step up your Open Source Security Game with Mend here
Vulnerable Library - mquery-1.6.3.tgz
Expressive query building for MongoDB
Library home page: https://registry.npmjs.org/mquery/-/mquery-1.6.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mquery/package.json
Dependency Hierarchy:
Found in HEAD commit: da47719753959d0828901e4fc615a2a867435543
Found in base branch: master
Vulnerability Details
lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., proto) can be copied during a merge or clone operation.
Publish Date: 2020-12-11
URL: CVE-2020-35149
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-12-11
Fix Resolution (mquery): 3.2.3
Direct dependency fix Resolution (mongoose): 5.11.7
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: