CVE-2019-15562 - GORM before 1.9.10 allows SQL injection via incomplete parentheses

Back Back to CVE browser

CRITICAL

GORM before 1.9.10 allows SQL injection via incomplete parentheses

Published Aug 26, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.66%

Description

GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427
x_refsource_MISCVendor Advisory
https://github.com/go-gorm/gorm/pull/2519
x_refsource_MISCThird Party Advisory
https://github.com/go-gorm/gorm/pull/2674
x_refsource_MISCVendor Advisory
https://github.com/jinzhu/gorm/releases/tag/v1.9.10
x_refsource_MISCRelease NotesThird Party Advisory

Link	Providers	Tags
https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427		x_refsource_MISCVendor Advisory
https://github.com/go-gorm/gorm/pull/2519		x_refsource_MISCThird Party Advisory
https://github.com/go-gorm/gorm/pull/2674		x_refsource_MISCVendor Advisory
https://github.com/jinzhu/gorm/releases/tag/v1.9.10		x_refsource_MISCRelease NotesThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 26, 2019

Updated Aug 5, 2024

Reserved Aug 25, 2019

Link CVE-2019-15562

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-15562

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-15562