CVE-2022-33171

Katalog CVE

CVSS 9.8 · Critical EPSS 21,4%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada typeorm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation

Rincian

Terbit di NVD

4 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

21,4% peluang dieksploitasi; lebih tinggi dari 97,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/168096/TypeORM-0.3.7-Information-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/Aug/7 mailing list · advisory pihak ketiga
• https://github.com/typeorm/typeorm/compare/0.2.45...0.3.0 release notes · advisory pihak ketiga
• https://seclists.org/fulldisclosure/2022/Jun/51 exploit · mailing list · advisory pihak ketiga