Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZmMjMtZjI2Zi1tamo5

Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls

Type juggling vulnerability in the API

Impact

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

Patches

https://github.com/YOURLS/YOURLS/releases/tag/1.7.4
https://github.com/YOURLS/YOURLS/pull/2542

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537
• https://github.com/Wocanilo/CVE-2019-14537

For more information

If you have any questions or comments about this advisory:

• Open an issue in YOURLS repository

Permalink: https://github.com/advisories/GHSA-vf23-f26f-mjj9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZmMjMtZjI2Zi1tamo5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-vf23-f26f-mjj9, CVE-2019-14537
References:

• https://github.com/YOURLS/YOURLS/security/advisories/GHSA-vf23-f26f-mjj9
• https://nvd.nist.gov/vuln/detail/CVE-2019-14537
• https://github.com/YOURLS/YOURLS/pull/2542
• https://github.com/Wocanilo/CVE-2019-14537
• https://github.com/YOURLS/YOURLS/commits/master
• https://github.com/YOURLS/YOURLS/releases
• https://github.com/advisories/GHSA-vf23-f26f-mjj9
• https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling

Repository: https://github.com/YOURLS/YOURLS
Blast Radius: 6.8

Affected Packages