CVE-2019-10757 - knex.js versions before 0.19.5 are vulnerable to SQL Injection attack

Back Back to CVE browser

CRITICAL

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack

Published Oct 8, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.16%

Description

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.

Affected products

Vendor n/a Product Knex.js Default
n/a
- Version
  All versions prior to version 0.19.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Knex.js

n/a

Version	Status	Constraints
All versions prior to version 0.19.5	affected	-

Ecosystem	Package	Introduced	Fixed
npm	knex	0	0.19.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://github.com/advisories/GHSA-58v4-qwx5-7f59
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10757
https://snyk.io/vuln/SNYK-JS-KNEX-471962
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-58v4-qwx5-7f59		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10757
https://snyk.io/vuln/SNYK-JS-KNEX-471962		x_refsource_CONFIRMExploitThird Party Advisory