GitHub Advisoryadvisory · npm

GHSA-mqr2-w7wj-jjgr mysql2 cache poisoning vulnerability

MEDIUM Published 2024-04-10 Modified 2024-08-02 Official page ↗
Aliases
CVE-2024-21507
Ecosystem
npm
Packages
mysql2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-20
Reviewed
2024-04-12

Affected packages

• npm mysql2: < 3.9.3 → fixed in 3.9.3

Description

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the `keyFromFields` function, resulting in cache poisoning. An attacker can inject a colon `:` character within a value of the attacker-crafted key.

Related

Alias · CVE (1)

  • CVE-2024-21507 Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References