Vulnerability · Published Apr 10, 2024 · Assigned by snyk
CVE-2024-21509
Medium 6.5
In plain English
A medium-severity prototype pollution in mysql2. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | mysql2 | 3.9.4 | GHSA-49j4-86m8-q2jw |
Affected products (as reported)
Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P
References
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084
- https://blog.slonser.info/posts/mysql2-attacker-configuration/
- https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134
- https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
- https://github.com/sidorares/node-mysql2/pull/2574
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4