CVE-2024-21512

May 29, 2024, 1:02 p.m.

Tags

CWE-1321
2024-05-29
CVE-2024-21512
report@snyk.io

CVSS Score

8.2 / 10

Product(s) Impacted

mysql2

  • before 3.9.8

Description

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

Weaknesses

Date

Published: May 29, 2024, 5:16 a.m.

Last Modified: May 29, 2024, 1:02 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

report@snyk.io

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

Base Score
8.2
Exploitability Score
Impact Score
Base Severity
HIGH
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
report@snyk.io
https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
report@snyk.io
https://github.com/sidorares/node-mysql2/pull/2702
report@snyk.io
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
report@snyk.io