Paper/Archive/CVE-2024-21508

CVE-2024-21508

mysql2 mysql2 — Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper va…

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 85.1.851 × 2017.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Affected

ProductAffectedFixed inSource

mysql2< 3.9.43.9.4CNA

mysql2< 3.9.43.9.4CISA-ADP

Scores by source

snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-MYSQL2-6591085 refblog.slonser.info/posts/mysql2-attacker-configuration refgithub.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21 refgithub.com/sidorares/node-mysql2/pull/2572 refgithub.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805 refgithub.com/sidorares/node-mysql2/releases/tag/v3.9.4