CRITICAL🇵🇱 Wersja polska

CVE-2019-10748

CVSS 9.8v3.1pub. 2019-10-29upd. 2024-11-21

Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sequelizejs Sequelize

    APP
    Sequelizejs
    3.0.0 – 3.35.1 (excl.)4.0.0 – 4.44.3 (excl.)5.0.0 – 5.8.11
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2023-25813CRITICAL10.0PL ✓same product

SQL Injection w Sequelize ORM przez mechanizm replacements

CVE-2023-22579CRITICAL9.9PL ✓same product

Sequelize.js — injection przez nieprawidłowe filtrowanie parametrów

CVE-2023-22578CRITICAL10.0PL ✓same product

SQL Injection w bibliotece Sequelize (brak filtrowania atrybutów)

CVE-2019-10749CRITICAL9.8PL ✓same product

SQL Injection w bibliotece Sequelize — brak sanityzacji kluczy JSON path (PostgreSQL)

CVE-2019-10752CRITICAL9.8PL ✓same product

SQL Injection w Sequelize przez funkcję pomocniczą sequelize.json()