CVE-2024-21511

CVSS V2 None CVSS V3 None

Description

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

Overview

CVE ID
CVE-2024-21511

Assigner
snyk

Vulnerability Status
PUBLISHED

Published Version
2024-04-23T05:00:00.602Z

Last Modified Date
2024-06-04T17:38:16.126Z

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

References

Reference URL	Reference Tags
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046
https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7
https://github.com/sidorares/node-mysql2/pull/2608
https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21511
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21511

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:13:15				Added to TrackCVE