CVE-2019-20149: Validation Bypass in kind-of
Summary
CVE-2019-20149: Validation Bypass in kind-of. Affects kind-of versions >= 6.0.0, < 6.0.3. Fixed in 6.0.3. How to fix ↓
Also tracked for
- node-kind-of · Debian:11
The same CVE-2019-20149 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'kind-of' package is an npm package that provides a utility function for determining the type of a given value. It is commonly used in JavaScript applications to perform type checks and validations. However, versions of 'kind-of' prior to 6.0.3 are vulnerable to a Validation Bypass. This vulnerability allows a maliciously crafted object to alter the result of the type check, enabling attackers to bypass the type checking validation.
Vulnerability Detail
The Validation Bypass vulnerability in 'kind-of' arises from a flaw in the type checking logic. By manipulating the input object, an attacker can modify the outcome of the type check, leading to incorrect type validation. This can have severe consequences, as it allows malicious actors to bypass important type checks and potentially exploit vulnerabilities or gain unauthorized access to sensitive data. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
6.0.3
This is the first release that contains the fix.
npm install kind-of@6.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the 'kind-of' package to address the issue effectively.
Conclusion
The 'kind-of' package is vulnerable to a Validation Bypass issue that allows attackers to bypass type checking validation. To mitigate this vulnerability, it is crucial to upgrade to version 6.0.3 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kind-of →
FAQ
The vulnerability allows attackers to bypass type checking validation, potentially leading to the exploitation of other vulnerabilities or unauthorized access to sensitive data.
Versions 6.x prior to 6.0.3 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and receive real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
The only known mitigation is to upgrade to version 6.0.3 or later of the 'kind-of' package.
