PT-2018-4728 · Sequelize · Sequelize

Mickhansen · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10550

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sequelize versions 3.16.0 and earlier

Description The issue concerns SQL Injection where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll. This allows a malicious user to inject their own SQL statements.

Recommendations For versions 3.16.0 and earlier, update to version 3.17.0 or later. As a temporary workaround, consider restricting user input for the limit and order parameters to prevent SQL injection attacks.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-10550

GHSA-98PQ-PMW9-4GPM

Produtos afetados

Sequelize

Referências · 7

• https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03 · Correção
• https://github.com/advisories/GHSA-98pq-pmw9-4gpm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10550 · Nota de Segurança
• https://npmjs.com/advisories/112 · Nota
• https://nodesecurity.io/advisories/112 · Correção
• https://osv.dev/vulnerability/CVE-2016-10550 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-98pq-pmw9-4gpm · Aviso do Fabricante