Closed mend-bolt-for-github[bot] closed 4 years ago
Multi dialect ORM for Node.JS
Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.12.2.tgz
Path to dependency file: /tmp/ws-scm/dadbot/package.json
Path to vulnerable library: /dadbot/node_modules/sequelize/package.json
Dependency Hierarchy: - :x: **sequelize-5.12.2.tgz** (Vulnerable Library)
Found in HEAD commit: 73f8fabe080c6ab870464da1b12c820b577efe11
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Publish Date: 2019-10-17
URL: CVE-2019-10752
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10752
Release Date: 2019-09-24
Fix Resolution: 4.44.3,5.15.1
Step up your Open Source Security Game with WhiteSource here
CVE-2019-10752 - High Severity Vulnerability
Multi dialect ORM for Node.JS
Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.12.2.tgz
Path to dependency file: /tmp/ws-scm/dadbot/package.json
Path to vulnerable library: /dadbot/node_modules/sequelize/package.json
Dependency Hierarchy: - :x: **sequelize-5.12.2.tgz** (Vulnerable Library)
Found in HEAD commit: 73f8fabe080c6ab870464da1b12c820b577efe11
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Publish Date: 2019-10-17
URL: CVE-2019-10752
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10752
Release Date: 2019-09-24
Fix Resolution: 4.44.3,5.15.1
Step up your Open Source Security Game with WhiteSource here