« Volver al listado

CVE-2024-21512

Estado: AplazadaAlta (8.2)—

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sidorares — Mysql2AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21512",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21512",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-29T14:07:58.190595Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "report@snyk.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "mysql2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.9.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "vendor": "n/a",
          "product": "org.webjars.npm:mysql2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "*",
              "versionType": "semver"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mysql2:mysql2:-:*:*:*:*:*:*:*"
          ],
          "vendor": "mysql2",
          "product": "mysql2",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.9.8",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-29T05:16:08.353",
  "references": [
    {
      "url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a",
      "source": "report@snyk.io"
    },
    {
      "url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc",
      "source": "report@snyk.io"
    },
    {
      "url": "https://github.com/sidorares/node-mysql2/pull/2702",
      "source": "report@snyk.io"
    },
    {
      "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010",
      "source": "report@snyk.io"
    },
    {
      "url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580",
      "source": "report@snyk.io"
    },
    {
      "url": "https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/sidorares/node-mysql2/pull/2702",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "report@snyk.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables."
    },
    {
      "lang": "es",
      "value": "Las versiones del paquete mysql2 anteriores a la 3.9.8 son vulnerables a la contaminación de prototipos debido a una sanitización inadecuada de las entradas del usuario pasadas a campos y tablas cuando se utilizan nestTables."
    }
  ],
  "lastModified": "2026-06-17T07:09:38.930",
  "sourceIdentifier": "report@snyk.io"
}