Quick answers
- Is CVE-2024-21507 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-21507 being exploited in the wild.
- How severe is CVE-2024-21507?
- Low severity, with a CVSS score of 3.1, published 10 April 2024.
- Which products and versions are affected?
- mysql2 (npm) before 3.9.3.
- Is there a fix for CVE-2024-21507?
- A patch was published on 2024-03-26: Fixed in version 3.9.3 via PR #2424 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-21507 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-21507?
- Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the keyFromFields function in mysql2 before 3.9.3, where improper input validation (CWE-20) allows an attacker to inject a colon character within cache key values. By crafting specific input, an attacker can poison the query result cache, causing the application to return incorrect cached data. The attack requires network access to an application using mysql2 but no authentication or user interaction. An attacker can exploit this to retrieve sensitive information or cause the application to operate with stale data. The vulnerability is fixed in version 3.9.3 through improved cache key serialization.
Affected products
- npm mysql2 before 3.9.3
Identifiers
- CVE-2024-21507
- GHSA-mqr2-w7wj-jjgr
Timeline
- 2024-04-10: disclosed
- 2024-03-26: patched: Fixed in version 3.9.3 via PR #2424