CVE-2019-19507
EUVD-2019-080102.12.2019, 17:15
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.EnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| json_pattern_validator_project | json_pattern_validator | 𝑥 < 2.1.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration