{"id":"CVE-2016-10550","published":"2018-05-31T20:00:00Z","modified":"2024-09-16T23:31:50Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and…","vendor":"HackerOne","product":"sequelize node module","tier":"tail","description":{"text":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01884,"percentile":0.79408,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://nodesecurity.io/advisories/112","tags":["x_refsource_MISC"]},{"url":"https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03","tags":["x_refsource_MISC"]}],"priority":{"score":15.9,"factors":[{"name":"EPSS percentile","points":15.88}]},"vendorSlug":"hackerone","affectedVersions":[{"vendor":"HackerOne","product":"sequelize node module","versions":["<= 3.16.0"]}],"affected":[{"ecosystem":"npm","package":"sequelize","vulnerableRanges":["<3.17.0"],"patched":["3.17.0"],"from":["GHSA-98pq-pmw9-4gpm"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0268","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hackerone-sequelize-node-module-cve-2016-10556","children":[{"from":"CVE-2016-10550","to":"CVE-2019-10748","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/dialects/abstract/query-generator.js"],"commits":["https://github.com/sequelize/sequelize/commit/f282d85e60e3df5e57ecdb82adccb4eaef404f03","https://github.com/sequelize/sequelize/commit/a72a3f50bad7772ce96fc62d80f64b109fb2893f"],"basis":"rarely changed file"}]},{"from":"CVE-2016-10550","to":"CVE-2019-10749","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/dialects/abstract/query-generator.js"],"commits":["https://github.com/sequelize/sequelize/commit/f282d85e60e3df5e57ecdb82adccb4eaef404f03","https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-10554","published":"2018-05-31","fixed":"1.7.0","kev":false},{"cve":"CVE-2015-1369","published":"2015-01-27","fixed":"2.0.0-rc8","kev":false},{"cve":"CVE-2016-10553","published":"2018-05-31","fixed":"3.0.0","kev":false,"link":{"from":"CVE-2016-10553","to":"CVE-2016-10550","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"3.0.0","toFixed":"3.17.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.86,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2016-10550","published":"2018-05-31","fixed":"3.17.0","kev":false},{"cve":"CVE-2016-10556","published":"2018-05-29","fixed":"3.20.0","kev":false,"link":{"from":"CVE-2016-10550","to":"CVE-2016-10556","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sequelize","fromFixed":"3.17.0","toFixed":"3.20.0","daysApart":-2},{"kind":"similar","provenance":"machine","score":0.56,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2019-10749","published":"2019-10-29","fixed":"3.35.1","kev":false},{"cve":"CVE-2019-11069","published":"2019-04-10","fixed":"5.3.0","kev":false}],"package":"npm:sequelize"}}