Published: 24/10/2019 Updated: 28/02/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Subscribe to Typestack Class-validator Project

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

Vulnerable Product	Search on Vulmon	Subscribe to Product
typestack class-validator project typestack class-validator 0.10.2

A note on versions Version 2x supports Eslint version <=7x and typescript eslint parser 4 Version 3x supports Eslint version >=8x and typescript eslint parser 5+ There were many breaking changes between these versions Index of available rules (more details for each specific rule are available in sections below) Nest Modules and Dependency Injection provided-

Kafka

A note on versions Version 2x supports Eslint version <=7x and typescript eslint parser 4 Version 3x supports Eslint version >=8x and typescript eslint parser 5+ There were many breaking changes between these versions typescript eslint parser supports a range of typescript versions but there can be a delay in supporting the latest versions This plugin only s

Some eslint rules for working with NestJs projects

A note on versions Version 4x supports Eslint version >=8x and typescript eslint parser ^6 Version 3x supports Eslint version >=8x and typescript eslint parser ^5 Version 2x supports Eslint version <=7x and typescript eslint parser ^4 There were many breaking changes between these versions typescript eslint parser supports a range of typescript ver

CWE-79 CWE-89 https://github.com/typestack/class-validator/issues/438 https://github.com/typestack/class-validator#passing-options https://github.com/typestack/class-validator/issues/438#issuecomment-964728471 https://github.com/typestack/class-validator/issues/1422#issuecomment-1344635415 https://nvd.nist.gov https://github.com/NarHakobyan/eslint-plugin-nestjs https://github.com/akogitrepo/drawio

CVE-2019-18413

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect