Search
Find a vulnerability
Search criteria
6 vulnerabilities found for mysql2 by mysql2
CVE-2024-21512 (GCVE-0-2024-21512)
Vulnerability from nvd – Published: 2024-05-29 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-29 14:07 UTC
CWE
- CWE-1321 - Prototype Pollution
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21512",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T14:07:58.190595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:33.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010"
},
{
"tags": [
"x_transferred"
],
"url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2702"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"product": "org.webjars.npm:mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donggyu Kim"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Prototype Pollution",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-15T15:25:04.084Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010"
},
{
"url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2702"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21512",
"datePublished": "2024-05-29T05:00:01.515Z",
"dateReserved": "2023-12-22T12:33:20.120Z",
"dateUpdated": "2024-08-01T22:20:40.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21511 (GCVE-0-2024-21511)
Vulnerability from nvd – Published: 2024-04-23 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-25 14:55 UTC
CWE
- CWE-94 - Arbitrary Code Injection
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21511",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-25T14:55:36.593699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:38:16.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2608"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "zhaoyudi (Nebulalab)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Arbitrary Code Injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-08T09:07:06.904Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046"
},
{
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2608"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21511",
"datePublished": "2024-04-23T05:00:00.602Z",
"dateReserved": "2023-12-22T12:33:20.120Z",
"dateUpdated": "2024-08-01T22:20:40.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21508 (GCVE-0-2024-21508)
Vulnerability from nvd – Published: 2024-04-11 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-11 13:05 UTC
CWE
- CWE-94 - Remote Code Execution (RCE)
Assigner
References
6 references
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-11T13:05:22.610894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T20:18:04.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085"
},
{
"tags": [
"x_transferred"
],
"url": "https://blog.slonser.info/posts/mysql2-attacker-configuration/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2572"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Vsevolod Kokorin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Remote Code Execution (RCE)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-05T15:25:03.937Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085"
},
{
"url": "https://blog.slonser.info/posts/mysql2-attacker-configuration/"
},
{
"url": "https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2572"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805"
},
{
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21508",
"datePublished": "2024-04-11T05:00:00.748Z",
"dateReserved": "2023-12-22T12:33:20.119Z",
"dateUpdated": "2024-08-01T22:20:40.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21512 (GCVE-0-2024-21512)
Vulnerability from cvelistv5 – Published: 2024-05-29 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-29 14:07 UTC
CWE
- CWE-1321 - Prototype Pollution
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21512",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T14:07:58.190595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:37:33.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010"
},
{
"tags": [
"x_transferred"
],
"url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2702"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"product": "org.webjars.npm:mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donggyu Kim"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Prototype Pollution",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-15T15:25:04.084Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010"
},
{
"url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2702"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21512",
"datePublished": "2024-05-29T05:00:01.515Z",
"dateReserved": "2023-12-22T12:33:20.120Z",
"dateUpdated": "2024-08-01T22:20:40.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21511 (GCVE-0-2024-21511)
Vulnerability from cvelistv5 – Published: 2024-04-23 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-25 14:55 UTC
CWE
- CWE-94 - Arbitrary Code Injection
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21511",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-25T14:55:36.593699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:38:16.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2608"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "zhaoyudi (Nebulalab)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Arbitrary Code Injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-08T09:07:06.904Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046"
},
{
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2608"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21511",
"datePublished": "2024-04-23T05:00:00.602Z",
"dateReserved": "2023-12-22T12:33:20.120Z",
"dateUpdated": "2024-08-01T22:20:40.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21508 (GCVE-0-2024-21508)
Vulnerability from cvelistv5 – Published: 2024-04-11 05:00 – Updated: 2024-08-01 22:20
VLAI
EPSS
VEX
Summary
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-11 13:05 UTC
CWE
- CWE-94 - Remote Code Execution (RCE)
Assigner
References
6 references
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mysql2",
"vendor": "mysql2",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-11T13:05:22.610894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-18T20:18:04.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085"
},
{
"tags": [
"x_transferred"
],
"url": "https://blog.slonser.info/posts/mysql2-attacker-configuration/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/pull/2572"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mysql2",
"vendor": "n/a",
"versions": [
{
"lessThan": "3.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Vsevolod Kokorin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Remote Code Execution (RCE)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-05T15:25:03.937Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085"
},
{
"url": "https://blog.slonser.info/posts/mysql2-attacker-configuration/"
},
{
"url": "https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21"
},
{
"url": "https://github.com/sidorares/node-mysql2/pull/2572"
},
{
"url": "https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805"
},
{
"url": "https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21508",
"datePublished": "2024-04-11T05:00:00.748Z",
"dateReserved": "2023-12-22T12:33:20.119Z",
"dateUpdated": "2024-08-01T22:20:40.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}