What is GHSA-p84x-5xx8-hff9?

GHSA-p84x-5xx8-hff9 is a security advisory published by GitHub Security Advisories with High severity. bson-objectid contains Improper input validation

Which CVE IDs does GHSA-p84x-5xx8-hff9 cover?

GHSA-p84x-5xx8-hff9 covers the following CVE IDs: CVE-2019-19729. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p84x-5xx8-hff9?

GHSA-p84x-5xx8-hff9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p84x-5xx8-hff9?

GHSA-p84x-5xx8-hff9 affects 1 product, including: npm/bson-objectid:\u003c= 1.3.0.

GHSA-p84x-5xx8-hff9HighCVSS 7.5

bson-objectid contains Improper input validation

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-19729 →

📋 Description

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.

🎯 Affected products1

npm/bson-objectid:<= 1.3.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-19729
https://github.com/williamkapke/bson-objectid/issues/30
https://www.npmjs.com/package/bson-objectid
https://github.com/advisories/GHSA-p84x-5xx8-hff9