CVE-2019-19729 - An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js

Back Back to CVE browser

HIGH

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js

Published Dec 11, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.08%

Description

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	bson-objectid	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-670

References (4)

https://github.com/advisories/GHSA-p84x-5xx8-hff9
Advisory
https://github.com/williamkapke/bson-objectid/issues/30
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19729
https://www.npmjs.com/package/bson-objectid
x_refsource_MISCProduct

Link	Providers	Tags
https://github.com/advisories/GHSA-p84x-5xx8-hff9		Advisory
https://github.com/williamkapke/bson-objectid/issues/30		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19729
https://www.npmjs.com/package/bson-objectid		x_refsource_MISCProduct