Products
mysql2
- before 3.9.7
Source
report@snyk.io
Tags
CVE-2024-21511 details
Published : April 23, 2024, 5:15 a.m.
Last Modified : April 23, 2024, 12:52 p.m.
Last Modified : April 23, 2024, 12:52 p.m.
Description
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9.8 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
9.8
Exploitability Score
Impact Score
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713 | report@snyk.io |
| https://github.com/sidorares/node-mysql2/pull/2608 | report@snyk.io |
| https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 | report@snyk.io |
| https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 | report@snyk.io |
This website uses the NVD API, but is not approved or certified by it.