PT-2018-4728 · Sequelize · Sequelize

Mickhansen · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10550

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sequelize versions 3.16.0 and earlier

Description The issue concerns SQL Injection where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll. This allows a malicious user to inject their own SQL statements.

Recommendations For versions 3.16.0 and earlier, update to version 3.17.0 or later. As a temporary workaround, consider restricting user input for the limit and order parameters to prevent SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-10550

GHSA-98PQ-PMW9-4GPM

Affected Products

Sequelize

References · 7

• https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10550 · Security Note
• https://nodesecurity.io/advisories/112 · Patch
• https://osv.dev/vulnerability/CVE-2016-10550 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98pq-pmw9-4gpm · Vendor Advisory
• https://github.com/advisories/GHSA-98pq-pmw9-4gpm · Note
• https://npmjs.com/advisories/112 · Note