CVE-2024-21507

CVSS 6.5 MEDIUMEPSS 0.7%CWE-20

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 abr 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P

Productos afectados

n/a · mysql2

Referencias

https://blog.slonser.info/posts/mysql2-attacker-configuration/https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818 https://github.com/sidorares/node-mysql2/pull/2424 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300