PT-2019-15862 · Json Pattern Validator · Jpv

Xiaofen9 · Published 2019-12-02 · Updated 2019-12-19 · CVE-2019-19507

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions jpv (aka Json Pattern Validator) versions prior to 2.1.1

Description The issue allows certain internal attributes to be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects the validate() function, enabling a crafted payload to manipulate the type detection result.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-19507

GHSA-RH46-3FGC-MVRF

Affected Products

Jpv

References · 5

• 🔥 https://github.com/manvel-khnkoyan/jpv/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19507 · Security Note
• https://osv.dev/vulnerability/GHSA-rh46-3fgc-mvrf · Vendor Advisory
• https://npmjs.com/package/jpv · Note