CVE-2019-10749 - sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect

Back Back to CVE browser

CRITICAL

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect

Published Oct 29, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.23%

Description

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.

Affected products

Vendor n/a Product Sequelize Default
n/a
- Version
  All versions prior to version 3.35.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Sequelize

n/a

Version	Status	Constraints
All versions prior to version 3.35.1	affected	-

Ecosystem	Package	Introduced	Fixed
npm	sequelize	0	3.35.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0721
Advisory
https://github.com/advisories/GHSA-2598-2f59-rmhq
Advisory
https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68
x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2019-10749
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222
x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/advisories/1017

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0721		Advisory
https://github.com/advisories/GHSA-2598-2f59-rmhq		Advisory
https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68		x_refsource_MISCPatch
https://nvd.nist.gov/vuln/detail/CVE-2019-10749
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222		x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/advisories/1017