CVE-2024-21509

Katalog CVE

CVSS 6.5 · Medium EPSS 0,96%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada sidorares mysql2. Skor CVSS 3.1 6.5 (Medium) menurut snyk.io.

Deskripsi (NVD)

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691 patch
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084 exploit · advisory pihak ketiga
• https://blog.slonser.info/posts/mysql2-attacker-configuration/ exploit · permissions required
• https://github.com/sidorares/node-mysql2/pull/2574 exploit · issue tracking
• https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser... broken link
• https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4 release notes