CVE-2019-10752
Summary
| CVE | CVE-2019-10752 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-10-17 19:15:00 UTC |
|---|
| Updated | 2023-11-07 03:02:00 UTC |
|---|
| Description | Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| github.com/sequelize/sequelize/commit/9bd0bc1%2C |
|
github.com |
|
| SQL Injection in sequelize | Snyk |
MISC |
snyk.io |
Exploit, Third Party Advisory |
| github.com/sequelize/sequelize/commit/9bd0bc1, |
MISC |
github.com |
Broken Link |
| Invalid vulnerability |
CONFIRM |
snyk.io |
Not Applicable |
| fix(sequelize.json.fn): use common path extraction for mysql/mariadb/… · sequelize/sequelize@9bd0bc1 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Page not found | Snyk |
|
snyk.io |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981638 Nodejs (npm) Security Update for sequelize (GHSA-m9jw-237r-gvfv)
