CVE-2019-18954: Injection Vulnerability

November 14, 2019 (updated November 18, 2019)

Pomelo allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.

References

github.com/NetEase/pomelo/issues/1149
nvd.nist.gov/vuln/detail/CVE-2019-18954

Code Behaviors & Features

Detect and mitigate CVE-2019-18954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →