PT-2019-14278 · Go · Gorm

Jonathan34 · Published 2019-08-26 · Updated 2024-08-05 · CVE-2019-15562

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GORM versions prior to 1.9.10

Description The issue allows SQL injection via incomplete parentheses. It is noted that misusing GORM by passing untrusted user input where GORM expects trusted SQL fragments is a vulnerability in the application, not in GORM.

Recommendations For versions prior to 1.9.10, update to version 1.9.10 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing user input to prevent SQL injection attacks. Restrict access to sensitive data and ensure that only trusted SQL fragments are passed to GORM.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-15562

Affected Products

Gorm

References · 7

• https://github.com/go-gorm/gorm/pull/2674 · Vendor Advisory
• https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15562 · Security Note
• https://github.com/go-gorm/gorm/pull/2519 · Note
• https://github.com/jinzhu/gorm/releases/tag/v1.9.10 · Note
• https://t.me/cvenotify/89095 · Telegram Post