CVE-2019-14537: Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls
Impact YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.
Patches https://github.com/YOURLS/YOURLS/releases/tag/1.7.4 https://github.com/YOURLS/YOURLS/pull/2542
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537 https://github.com/Wocanilo/CVE-2019-14537
For more information If you have any questions or comments about this advisory: Open an issue in YOURLS repository
Other sources
Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yourls/yourlsto a version that resolves this vulnerability.Fixed in 1.7.4 - Upgrade
Upgrade
yourls/yourlsto a version that resolves this vulnerability.Fixed in 1.7.4
Event History
Frequently Asked Questions
What is CVE-2019-14537?
CVE-2019-14537 is a type juggling vulnerability in the YOURLS through 1.7.3 API component that can result in login bypass.
How severe is CVE-2019-14537?
CVE-2019-14537 has a severity score of 9.8, which is considered critical.
What software versions are affected by CVE-2019-14537?
YOURLS versions up to and including 1.7.3 are affected by CVE-2019-14537.
How can I fix CVE-2019-14537?
To fix CVE-2019-14537, you should update YOURLS to a version higher than 1.7.3.
Where can I find more information about CVE-2019-14537?
You can find more information about CVE-2019-14537 on the following references: [GitHub](https://github.com/Wocanilo/CVE-2019-14537), [YOURLS Commits](https://github.com/YOURLS/YOURLS/commits/master), [YOURLS Pull Request](https://github.com/YOURLS/YOURLS/pull/2542).