GHSA-hxwc-5vw9-2w4w json
NoSQL Injection in loopback-connector-mongodb
published 6y ago modified 5y ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
## Recommendation
Upgrade to version 3.6.0 or later.
Patch / fix
- npm loopback-connector-mongodb 3.6.0
Is GHSA-hxwc-5vw9-2w4w in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | loopback-connector-mongodb | <3.6.0 |
3.6.0 |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
Sources
- GitHub Advisory GHSA-hxwc-5vw9-2w4w
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.