sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
CVE-2016-10550 - High Severity Vulnerability
Multi dialect ORM for Node.JS/io.js
Library home page: https://registry.npmjs.org/sequelize/-/sequelize-3.14.2.tgz
Path to dependency file: /todoapp/nodejs_api/package.json
Path to vulnerable library: /todoapp/nodejs_api/node_modules/sequelize/package.json,/todoapp/nodejs/node_modules/sequelize/package.json
Dependency Hierarchy: - :x: **sequelize-3.14.2.tgz** (Vulnerable Library)
Found in base branch: master
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Publish Date: 2018-05-31
URL: CVE-2016-10550
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2018-05-31
Fix Resolution: 3.17.0
Step up your Open Source Security Game with Mend here