mongoose-5.3.16.tgz: 13 vulnerabilities (highest severity is: 9.8) #19
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.3.16.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - mongoose-5.3.16.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.3.16.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
Publish Date: 2023-07-17
URL: CVE-2023-3696
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467/
Release Date: 2023-07-17
Fix Resolution: 5.13.21
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mongoose-5.3.16.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.3.16.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Publish Date: 2022-07-28
URL: CVE-2022-2564
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2564
Release Date: 2022-07-28
Fix Resolution: 5.13.15
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mpath-0.5.1.tgz
{G,S}et object values using MongoDB-like path notation
Library home page: https://registry.npmjs.org/mpath/-/mpath-0.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mpath/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Publish Date: 2021-09-01
URL: CVE-2021-23438
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23438
Release Date: 2021-09-01
Fix Resolution (mpath): 0.8.4
Direct dependency fix Resolution (mongoose): 5.13.9
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - bson-1.1.0.tgz
A bson parser for node.js and the browser
Library home page: https://registry.npmjs.org/bson/-/bson-1.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/bson/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Publish Date: 2020-03-30
URL: CVE-2020-7610
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-04-01
Fix Resolution (bson): 1.1.4
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mongoose-5.3.16.tgz
Mongoose MongoDB ODM
Library home page: https://registry.npmjs.org/mongoose/-/mongoose-5.3.16.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongoose/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Publish Date: 2019-10-10
URL: CVE-2019-17426
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17426
Release Date: 2019-10-10
Fix Resolution: 5.7.5
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.11.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - async-2.6.1.tgz
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-2.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 2.6.4
Direct dependency fix Resolution (mongoose): 5.7.3
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.11.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution (lodash): 4.17.19
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.11.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mongodb-3.1.10.tgz
The official MongoDB driver for Node.js
Library home page: https://registry.npmjs.org/mongodb/-/mongodb-3.1.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mongodb/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
In 'node-mongodb-native', versions prior to v3.1.13 are vulnerable against DOS as a result of a potential crash when a collection name is invalid and the DB doesn't exist.
Publish Date: 2019-01-23
URL: WS-2019-0311
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1203
Release Date: 2019-01-23
Fix Resolution (mongodb): 3.1.13
Direct dependency fix Resolution (mongoose): 5.4.10
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - bson-1.1.0.tgz
A bson parser for node.js and the browser
Library home page: https://registry.npmjs.org/bson/-/bson-1.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/bson/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Publish Date: 2020-03-31
URL: CVE-2019-2391
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2391
Release Date: 2020-03-31
Fix Resolution (bson): 1.1.4
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mquery-3.2.0.tgz
Expressive query building for MongoDB
Library home page: https://registry.npmjs.org/mquery/-/mquery-3.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mquery/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., proto) can be copied during a merge or clone operation.
Publish Date: 2020-12-11
URL: CVE-2020-35149
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-12-11
Fix Resolution (mquery): 3.2.3
Direct dependency fix Resolution (mongoose): 5.11.7
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - lodash-4.17.11.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 09a6c8830d7c790f40d96c37ec8e5ad2bae92e5e
Found in base branch: main
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (mongoose): 5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: