PT-2019-12024 · Sequelize · Sequelize

Publicado 2019-10-29 · Atualizado 2019-11-08 · CVE-2019-10749

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sequelize versions prior to 3.35.1

Description The issue allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. This may allow attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendations For versions prior to 3.35.1, upgrade to version 3.35.1 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-10749

GHSA-2598-2F59-RMHQ

SNYK-JS-SEQUELIZE-450222

Produtos afetados

Sequelize

Referências · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222 · Exploit
• https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-10749 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10749 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2598-2f59-rmhq · Aviso do Fabricante
• https://npmjs.com/advisories/1017 · Nota