search

sultanabubaker / SAST-npm-project

0 stars 0 forks source link

mongoose-4.4.10.tgz: 5 vulnerabilities (highest severity is: 9.8) #14

Open dev-mend-for-github-com[bot] opened 2 years ago

dev-mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - mongoose-4.4.10.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.4.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2020-7610 High 9.8 bson-0.4.21.tgz Transitive 6.2.11 ✅
CVE-2019-17426 High 9.1 mongoose-4.4.10.tgz Direct 4.13.20 ✅
CVE-2018-16490 High 7.5 mpath-0.2.1.tgz Transitive 6.2.11 ✅
WS-2018-0224 Medium 6.0 mpath-0.2.1.tgz Transitive 6.2.11 ✅
CVE-2020-35149 Medium 5.3 mquery-1.10.0.tgz Transitive 6.2.11 ✅

Details

CVE-2020-7610 ### Vulnerable Library - bson-0.4.21.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-0.4.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bson/package.json

Dependency Hierarchy: - mongoose-4.4.10.tgz (Root Library) - :x: **bson-0.4.21.tgz** (Vulnerable Library)

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Found in base branch: main

### Vulnerability Details

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Publish Date: 2020-03-30

URL: CVE-2020-7610

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/mongodb/js-bson/releases/tag/v1.1.4

Release Date: 2020-04-01

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongoose): 6.2.11

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2019-17426 ### Vulnerable Library - mongoose-4.4.10.tgz

Mongoose MongoDB ODM

Library home page: https://registry.npmjs.org/mongoose/-/mongoose-4.4.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongoose/package.json

Dependency Hierarchy: - :x: **mongoose-4.4.10.tgz** (Vulnerable Library)

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Found in base branch: main

### Vulnerability Details

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Publish Date: 2019-10-10

URL: CVE-2019-17426

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17426

Release Date: 2019-10-10

Fix Resolution: 4.13.20

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2018-16490 ### Vulnerable Library - mpath-0.2.1.tgz

{G,S}et object values using MongoDB-like path notation

Library home page: https://registry.npmjs.org/mpath/-/mpath-0.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mpath/package.json

Dependency Hierarchy: - mongoose-4.4.10.tgz (Root Library) - :x: **mpath-0.2.1.tgz** (Vulnerable Library)

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Found in base branch: main

### Vulnerability Details

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16490

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390860

Release Date: 2019-02-01

Fix Resolution (mpath): 0.5.1

Direct dependency fix Resolution (mongoose): 6.2.11

:rescue_worker_helmet: Automatic Remediation is available for this issue
WS-2018-0224 ### Vulnerable Library - mpath-0.2.1.tgz

{G,S}et object values using MongoDB-like path notation

Library home page: https://registry.npmjs.org/mpath/-/mpath-0.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mpath/package.json

Dependency Hierarchy: - mongoose-4.4.10.tgz (Root Library) - :x: **mpath-0.2.1.tgz** (Vulnerable Library)

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Found in base branch: main

### Vulnerability Details

Mpath, versions 0.0.1--0.0.5, have a Prototype Pollution Vulnerability. An attacker can specify a path that include the prototype object.

Publish Date: 2018-08-30

URL: WS-2018-0224

### CVSS 3 Score Details (6.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: N/A - Attack Complexity: N/A - Privileges Required: N/A - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390860

Release Date: 2018-08-30

Fix Resolution (mpath): 0.5.1

Direct dependency fix Resolution (mongoose): 6.2.11

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-35149 ### Vulnerable Library - mquery-1.10.0.tgz

Expressive query building for MongoDB

Library home page: https://registry.npmjs.org/mquery/-/mquery-1.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mquery/package.json

Dependency Hierarchy: - mongoose-4.4.10.tgz (Root Library) - :x: **mquery-1.10.0.tgz** (Vulnerable Library)

Found in HEAD commit: d804f0146ba2b48648893ac54a20b8bcb43f60d5

Found in base branch: main

### Vulnerability Details

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.

Publish Date: 2020-12-11

URL: CVE-2020-35149

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/aheckmann/mquery/releases/tag/3.2.3

Release Date: 2020-12-11

Fix Resolution (mquery): 3.2.3

Direct dependency fix Resolution (mongoose): 6.2.11

:rescue_worker_helmet: Automatic Remediation is available for this issue

:rescue_worker_helmet: Automatic Remediation is available for this issue.