CVE-2015-9244

Опубликовано: 29 мая 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with mysql.escape() which could lead to SQL Injection.

Ссылки

https://github.com/felixge/node-mysql/issues/342
Exploit
Third Party Advisory
https://nodesecurity.io/advisories/66
Third Party Advisory
https://github.com/felixge/node-mysql/issues/342
Exploit
Third Party Advisory
https://nodesecurity.io/advisories/66
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mysqljs:mysql:*:*:*:*:*:node.js:*:*

Версия до 0.9.6 (включая)

cpe:2.3:a:mysqljs:mysql:2.0.0:alpha:*:*:*:node.js:*:*

cpe:2.3:a:mysqljs:mysql:2.0.0:alpha2:*:*:*:node.js:*:*

cpe:2.3:a:mysqljs:mysql:2.0.0:alpha3:*:*:*:node.js:*:*

cpe:2.3:a:mysqljs:mysql:2.0.0:alpha4:*:*:*:node.js:*:*

cpe:2.3:a:mysqljs:mysql:2.0.0:alpha7:*:*:*:node.js:*:*

cpe:2.3:a:mysqljs:mysql:2.0.0:preview:*:*:*:node.js:*:*

EPSS

Процентиль: 76%

0.00941

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2015-9244

CVSS3: 9.8

ubuntu

больше 7 лет назад

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

CVE-2015-9244

CVSS3: 9.8

debian

больше 7 лет назад

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not ...

GHSA-fvq6-55gv-jx9f

github

больше 5 лет назад

SQL Injection in mysql

EPSS

Процентиль: 76%

0.00941

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89