CVE-2019-10748 in Sequelize

Résumé

par MITRE

Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Réserver: 03/04/2019
• Modérer: accepté
• Entrée: VDB-144414
• CPE: prêt
• CWE: CWE-89 (confirmé)
• CVSS: 9.8 (NVD)
• EPSS: 0.01315
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2019-10748
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-10748
• CVE Details: https://www.cvedetails.com/cve/CVE-2019-10748/