github.com/jinzhu/gorm-v1.9: 1 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com[bot]]

Vulnerable Library - github.com/jinzhu/gorm-v1.9

The fantastic ORM library for Golang, aims to be developer friendly

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Found in HEAD commit: 65bcd58cd4b5f086be7b413b47676b24145763de

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (github.com/jinzhu/gorm-v1.9 version)	Remediation Possible**
CVE-2019-15562	Critical	9.8	github.com/jinzhu/gorm-v1.9	Direct	v1.9.10	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-15562

### Vulnerable Library - github.com/jinzhu/gorm-v1.9

The fantastic ORM library for Golang, aims to be developer friendly

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy: - :x: **github.com/jinzhu/gorm-v1.9** (Vulnerable Library)

Found in HEAD commit: 65bcd58cd4b5f086be7b413b47676b24145763de

Found in base branch: main

### Vulnerability Details

GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm

Publish Date: 2019-08-26

URL: CVE-2019-15562

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15562

Release Date: 2019-08-26

Fix Resolution: v1.9.10

In order to enable automatic remediation, please create workflow rules

---

In order to enable automatic remediation for this issue, please create workflow rules