CVE-2024-21507

CVSS 6.5 MEDIUMEPSS 0.7%CWE-20

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 abr 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P

Produtos afetados

n/a · mysql2

Referências

https://blog.slonser.info/posts/mysql2-attacker-configuration/https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818 https://github.com/sidorares/node-mysql2/pull/2424 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300