PT-2019-20075 · Sequelize · Sequelize

Publicado 2019-06-04 · Atualizado 2019-06-04

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions sequelize versions prior to 4.12.0

Description The issue affects the sequelize library, where query operators such as $gt are not properly sanitized. This may allow an attacker to alter data queries, leading to NoSQL Injection.

Recommendations For versions prior to 4.12.0, upgrade to version 4.12.0 or later.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

GHSA-WFP9-VR4J-F49J

Produtos afetados

Sequelize

Referências · 6

• https://github.com/sequelize/sequelize · Nota
• https://github.com/sequelize/sequelize/issues/7310 · Nota
• https://github.com/sequelize/sequelize/pull/8240 · Nota
• https://github.com/sequelize/sequelize/commit/ccb99daedb69e8750a241436415ccac8abef358d · Nota
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174147 · Nota
• https://osv.dev/vulnerability/GHSA-wfp9-vr4j-f49j · Aviso do Fabricante