CVE-2024-21507

Published: Apr 10, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

Affected (1)

Products: Sidorares: Mysql2

Sidorares

1 product

Mysql2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sidorares Mysql2	Before 3.9.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

https://blog.slonser.info/posts/mysql2-attacker-configuration/

Source: report@snyk.io

ExploitPermissions Required

https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818

Source: report@snyk.io

Patch

https://github.com/sidorares/node-mysql2/pull/2424

Source: report@snyk.io

ExploitIssue Tracking

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300

Source: report@snyk.io

ExploitThird Party Advisory

https://blog.slonser.info/posts/mysql2-attacker-configuration/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPermissions Required

https://github.com/sidorares/node-mysql2/commit/0d54b0ca6498c823098426038162ef10df02c818

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/sidorares/node-mysql2/pull/2424

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591300

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.