VDB
CVE-2024-21509
CVE-2024-21509
PUBLISHED
CVSS 6.900000095367432 MEDIUM
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
EPSS 0.95% · 61.0th percentile
Risk Scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS Score
0.95%
61.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | mysql2 | 0 |
| npm | mysql2 | 0 |
| mysqljs | mysql2 | 0 |
| sidorares | mysql2 | 0 |
Timeline
- Apr 10, 2024 CVE Published
- Apr 10, 2024 EPSS Score
- Apr 12, 2024 CVE Updated
- May 6, 2024 EPSS Score
- Jun 1, 2024 EPSS Score
- Jul 23, 2024 EPSS Score
- Aug 18, 2024 EPSS Score
- Sep 13, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 9, 2024 EPSS Score
- Nov 30, 2024 EPSS Score
- Dec 27, 2024 EPSS Score
References
- https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691 fix
- https://github.com/sidorares/node-mysql2/pull/2574 fix
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084 url
- https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134 url
- https://blog.slonser.info/posts/mysql2-attacker-configuration/ url
- https://nvd.nist.gov/vuln/detail/CVE-2024-21509 advisory
- https://blog.slonser.info/posts/mysql2-attacker-configuration url
- https://github.com/sidorares/node-mysql2 package
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4 fix