PT-2019-14278 · Go · Gorm

Jonathan34 · Publicado 2019-08-26 · Atualizado 2024-08-05 · CVE-2019-15562

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GORM versions prior to 1.9.10

Description The issue allows SQL injection via incomplete parentheses. It is noted that misusing GORM by passing untrusted user input where GORM expects trusted SQL fragments is a vulnerability in the application, not in GORM.

Recommendations For versions prior to 1.9.10, update to version 1.9.10 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input to prevent SQL injection attacks. Restrict access to sensitive data and ensure that only trusted SQL fragments are passed to GORM.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-15562

Produtos afetados

Gorm

Referências · 7

• https://github.com/go-gorm/gorm/pull/2519 · Nota
• https://github.com/go-gorm/gorm/pull/2674 · Aviso do Fabricante
• https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427 · Aviso do Fabricante
• https://github.com/jinzhu/gorm/releases/tag/v1.9.10 · Nota
• https://osv.dev/vulnerability/CVE-2019-15562 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15562 · Nota de Segurança
• https://t.me/cvenotify/89095 · Publicação no Telegram