CVE-2019-10805: Exposure of Resource to Wrong Sphere

February 28, 2020 (updated March 5, 2020)

valib allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.

References

nvd.nist.gov/vuln/detail/CVE-2019-10805

Code Behaviors & Features

Detect and mitigate CVE-2019-10805 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →