CVE-2024-21512
- State
- Published
- Severity
- 8.2 High
- Published
- May 29, 2024
- Updated
- Aug 1, 2024
- Reserved
- Dec 22, 2023
Description
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P | snyk |
Weaknesses
- CWE-1321 Prototype Pollution
Affected Products
| Product | Versions |
|---|---|
mysql2n/a |
|
org.webjars.npm:mysql2n/a |
|
References
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
- https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
- https://github.com/sidorares/node-mysql2/pull/2702
- https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.