PT-2019-6147 · Sequelize · Sequelize

Publicado 2019-08-18 · Atualizado 2019-10-25 · CVE-2019-10752

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 4.44.3 and 5.15.1

Description The issue is related to the sequelize.json() helper function not properly escaping values when formatting sub paths for JSON queries for MySQL, MariaDB, and SQLite, leading to SQL Injection. This allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. The vulnerability may impact the confidentiality, integrity, and availability of protected information.

Recommendations If you are using Sequelize 5.x, upgrade to version 5.15.1 or later. If you are using Sequelize 4.x, upgrade to version 4.44.3 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2022-00005

CVE-2019-10752

GHSA-M9JW-237R-GVFV

SNYK-JS-SEQUELIZE-459751

SNYK-JS-SEQUELIZE-459751

Produtos afetados

Sequelize

Referências · 13

• 🔥 https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751 · Exploit
• https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e · Correção
• https://github.com/sequelize/sequelize/commit/9bd0bc1%2C · Nota
• https://github.com/sequelize/sequelize/pull/11329 · Nota
• https://github.com/sequelize/sequelize/commit/9bd0bc1, · Nota
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C · Nota
• https://osv.dev/vulnerability/CVE-2019-10752 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10752 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m9jw-237r-gvfv · Aviso do Fabricante
• https://npmjs.com/advisories/1146 · Nota
• https://bdu.fstec.ru/vul/2022-00005 · Nota de Segurança
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751, · Nota
• https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-459751 · Nota