{"id":"CVE-2019-10748","published":"2019-10-28T21:42:45Z","modified":"2024-08-04T22:32:01Z","title":"Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not…","vendor":null,"product":null,"tier":"tail","description":{"text":"Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01315,"percentile":0.70758,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450221","tags":["x_refsource_MISC"]},{"url":"https://github.com/sequelize/sequelize/commit/a72a3f5%2C","tags":["x_refsource_MISC"]},{"url":"https://github.com/sequelize/sequelize/pull/11089%2C","tags":["x_refsource_MISC"]}],"priority":{"score":14.2,"factors":[{"name":"EPSS percentile","points":14.15}]},"affectedVersions":[{"vendor":"n/a","product":"Sequelize","versions":["All versions prior to 3.35.1","All versions prior to 4.44.3","All versions prior to 5.8.11"]}],"affected":[{"ecosystem":"npm","package":"sequelize","vulnerableRanges":["<3.35.1",">=4.0.0, <4.44.3",">=5.0.0, <5.8.11"],"patched":["3.35.1","4.44.3","5.8.11"],"from":["GHSA-j9xp-92vc-559j"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0753","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-10556","published":"2018-05-29","fixed":"3.20.0","kev":false,"link":{"from":"CVE-2016-10556","to":"CVE-2019-10748","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"3.20.0","toFixed":"3.35.1","daysApart":517}]}},{"cve":"CVE-2019-10749","published":"2019-10-29","fixed":"3.35.1","kev":false},{"cve":"CVE-2019-11069","published":"2019-04-10","fixed":"5.3.0","kev":false,"link":{"from":"CVE-2019-11069","to":"CVE-2019-10748","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"5.3.0","toFixed":"5.8.11","daysApart":201}]}},{"cve":"CVE-2019-10748","published":"2019-10-28","fixed":"5.8.11","kev":false},{"cve":"CVE-2019-10752","published":"2019-10-17","fixed":"5.15.1","kev":false},{"cve":"CVE-2023-25813","published":"2023-02-22","fixed":"6.19.1","kev":false},{"cve":"CVE-2023-22579","published":"2023-02-16","fixed":"6.28.1","kev":false}],"package":"npm:sequelize"}}