CRITICAL🇵🇱 Wersja polska

CVE-2019-10752

CVSS 9.8v3.1pub. 2019-10-17upd. 2024-11-21

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sequelizejs Sequelize

    APP
    Sequelizejs
    4.0.0 – 4.44.3 (excl.)5.0.0 – 5.15.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2023-25813CRITICAL10.0PL ✓same product

SQL Injection w Sequelize ORM przez mechanizm replacements

CVE-2023-22579CRITICAL9.9PL ✓same product

Sequelize.js — injection przez nieprawidłowe filtrowanie parametrów

CVE-2023-22578CRITICAL10.0PL ✓same product

SQL Injection w bibliotece Sequelize (brak filtrowania atrybutów)

CVE-2019-10748CRITICAL9.8PL ✓same product

SQL Injection w Sequelize przez nieprawidłowe eskejpowanie kluczy JSON path

CVE-2019-10749CRITICAL9.8PL ✓same product

SQL Injection w bibliotece Sequelize — brak sanityzacji kluczy JSON path (PostgreSQL)