{"id":"CVE-2024-21508","published":"2024-04-11T05:00:00Z","modified":"2024-08-01T22:20:40Z","title":"Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function…","vendor":null,"product":null,"tier":"tail","description":{"text":"Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02554,"percentile":0.85058,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085","tags":[]},{"url":"https://blog.slonser.info/posts/mysql2-attacker-configuration/","tags":[]},{"url":"https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21","tags":[]},{"url":"https://github.com/sidorares/node-mysql2/pull/2572","tags":[]},{"url":"https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805","tags":[]},{"url":"https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4","tags":[]}],"priority":{"score":23.9,"factors":[{"name":"EPSS percentile","points":17.01},{"name":"CVSS severity","points":6.86}]},"affectedVersions":[{"vendor":"n/a","product":"mysql2","versions":["< 3.9.4"]}],"affected":[{"ecosystem":"npm","package":"mysql2","vulnerableRanges":["<3.9.4"],"patched":["3.9.4"],"from":["GHSA-fpw7-j2hg-69v5"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1197","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-21507","published":"2024-04-10","fixed":"3.9.3","kev":false,"link":{"from":"CVE-2024-21507","to":"CVE-2024-21508","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:mysql2","fromFixed":"3.9.3","toFixed":"3.9.4","daysApart":1}]}},{"cve":"CVE-2024-21508","published":"2024-04-11","fixed":"3.9.4","kev":false},{"cve":"CVE-2024-21509","published":"2024-04-10","fixed":"3.9.4","kev":false},{"cve":"CVE-2024-21511","published":"2024-04-23","fixed":"3.9.7","kev":false,"link":{"from":"CVE-2024-21508","to":"CVE-2024-21511","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:mysql2","fromFixed":"3.9.4","toFixed":"3.9.7","daysApart":12}]}},{"cve":"CVE-2024-21512","published":"2024-05-29","fixed":"3.9.8","kev":false}],"package":"npm:mysql2"}}