| CVE | CVE-2024-21511 |
| CVE Title | |
| Published Date | 2024-04-23T05:15Z |
| Modified Date | 2024-04-23T12:52Z |
| Description | Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function. |
| References | |
| By clicking these links you will leave this website. We do not endorse and will not be held accountable for any activity on external sites. | |
| Reference URL | https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 |
| Reference Description | https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 |
| Reference URL | https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 |
| Reference Description | https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 |
| Reference URL | https://github.com/sidorares/node-mysql2/pull/2608 |
| Reference Description | https://github.com/sidorares/node-mysql2/pull/2608 |
| Reference URL | https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713 |
| Reference Description | https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713 |
| Sources | NIST MITRE |
Note
- No CVSS data for this CVE