SQL Injection Vulnerability in Sequelize ORM by Sequelize
CVE-2016-10553

9.8CRITICAL

Key Information:

Vendor

Hackerone

Status
Sequelize Node Module
Vendor
CVE Published:
31 May 2018

What is CVE-2016-10553?

A vulnerability exists in Sequelize ORM that enables potential SQL injection attacks due to improper handling of user-supplied input. This could allow attackers to craft malicious queries that may compromise the underlying database systems such as Postgres, MySQL, MariaDB, SQLite, and Microsoft SQL Server. The issue was addressed in version 2.1.4 and later releases, highlighting the importance of updating to these versions to mitigate security risks.

Affected Version(s)

sequelize node module <= 2.1.3

References

https://nodesecurity.io/advisories/109
x_refsource_MISC
https://github.com/sequelize/sequelize/blob/master/change...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-10553 : SQL Injection Vulnerability in Sequelize ORM by Sequelize