CVE-2016-10553

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.

Published: May 31, 2018
Updated: May 9, 2024
CVE: CVE-2016-10553
GHSA: GHSA-2v7q-2xqx-f4q5
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
sequelizejs / sequelize	-	2.1.3.x
sequelize	-	3.0.0

https://github.com/sequelize/sequelize/blob/master/changelog.md#300
https://nodesecurity.io/advisories/109
https://www.npmjs.com/advisories/109

Vulnerability Database

CVE-2016-10553