CVE-2019-10757 (Critical) detected in knex-0.15.2.tgz

[mend-bolt-for-github]

CVE-2019-10757 - Critical Severity Vulnerability

Vulnerable Library - knex-0.15.2.tgz

A batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser

Library home page: https://registry.npmjs.org/knex/-/knex-0.15.2.tgz

Path to dependency file: /api-crud-adonisjs/package.json

Path to vulnerable library: /node_modules/knex/package.json

Dependency Hierarchy:

• lucid-6.1.3.tgz (Root Library)
  • ❌ knex-0.15.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.

Publish Date: 2019-10-08

URL: CVE-2019-10757

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10757

Release Date: 2019-10-08

Fix Resolution (knex): 0.19.5

Direct dependency fix Resolution (@adonisjs/lucid): 6.3.0

---

Step up your Open Source Security Game with Mend here