요약
- CVE-2016-10550은(는) sequelize (sequelizejs), sequelize에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.5%보다 높음.
- 조치: 3.17.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| sequelize | ≤ 3.16.0
| No fix yet |
| sequelize npm | < 3.17.0
| 3.17.0
|
Description
Affected versions of sequelize are vulnerable to SQL Injection in locations where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll.
Recommendation
Update to version 3.17.0 or later.
NVD description
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free