{"id":"CVE-2019-10749","published":"2019-10-29T16:06:05Z","modified":"2024-08-04T22:32:01Z","title":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being…","vendor":null,"product":null,"tier":"tail","description":{"text":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01228,"percentile":0.68881,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222","tags":["x_refsource_MISC"]},{"url":"https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68","tags":["x_refsource_MISC"]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":13.78}]},"affectedVersions":[{"vendor":"n/a","product":"sequelize","versions":["All versions prior to version 3.35.1"]}],"affected":[{"ecosystem":"npm","package":"sequelize","vulnerableRanges":["<3.35.1"],"patched":["3.35.1"],"from":["GHSA-2598-2f59-rmhq"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0721","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-10553","published":"2018-05-31","fixed":"3.0.0","kev":false},{"cve":"CVE-2016-10550","published":"2018-05-31","fixed":"3.17.0","kev":false},{"cve":"CVE-2016-10556","published":"2018-05-29","fixed":"3.20.0","kev":false,"link":{"from":"CVE-2016-10556","to":"CVE-2019-10749","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"3.20.0","toFixed":"3.35.1","daysApart":518}]}},{"cve":"CVE-2019-10749","published":"2019-10-29","fixed":"3.35.1","kev":false},{"cve":"CVE-2019-11069","published":"2019-04-10","fixed":"5.3.0","kev":false},{"cve":"CVE-2019-10748","published":"2019-10-28","fixed":"5.8.11","kev":false},{"cve":"CVE-2019-10752","published":"2019-10-17","fixed":"5.15.1","kev":false}],"package":"npm:sequelize"}}