PT-2020-7933 · Sequelize · Sequelize

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000225

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: sequelize versions prior to 3.23.6

Description: The issue affects models with fields of the GEOMETRY DataType, leading to SQL Injection. This occurs because single quotes in document values are not properly escaped for GeoJSON documents using ST GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.

Recommendations: Update to version 3.23.6 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-1000225

GHSA-5V9H-Q3GJ-C32X

Affected Products

Sequelize

References · 11

• https://osv.dev/vulnerability/GHSA-5v9h-q3gj-c32x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000225 · Security Note
• https://github.com/sequelize/sequelize · Note
• https://github.com/sequelize/sequelize/commit/f93af43a1d86400487f5e3d9762f1a4b7cf6b1e1 · Note
• https://github.com/sequelize/sequelize/commit/18ac91040d9c57351d26ba998f460e214255b704 · Note
• https://github.com/sequelize/sequelize/issues/6194 · Note
• https://github.com/sequelize/sequelize/commit/14e3deaf3ad27f12900e5275db1d448844c9de3e · Note
• https://github.com/sequelize/sequelize/pull/6302 · Note
• https://github.com/sequelize/sequelize/commit/562d52585902090f4e53eb21c61314098c29d795 · Note
• https://github.com/sequelize/sequelize/pull/6306 · Note
• https://snyk.io/vuln/npm:sequelize:20160718 · Note