CRITICAL🇵🇱 Wersja polska

CVE-2019-10752

CVSS 9.8v3.1pub. 2019-10-17upd. 2024-11-21

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sequelizejs Sequelize

    APP
    Sequelizejs
    4.0.0 – 4.44.3 (bez)5.0.0 – 5.15.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2023-25813CRITICAL10.0ten sam produkt

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replace...

CVE-2023-22579CRITICAL9.9ten sam produkt

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

CVE-2023-22578CRITICAL10.0ten sam produkt

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.

CVE-2019-10748CRITICAL9.8ten sam produkt

Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path ke...

CVE-2019-10749CRITICAL9.8ten sam produkt

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not bein...