npm/@curveball/a12n-server: medium 6.5
a12nserver vulnerable to potential SQL Injections via Knex dependency
Action: Upgrade @curveball/a12n-server to 0.23.0 or later.
npm i @curveball/a12n-server@0.23.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.20.0 | 0.23.0 | - |
Fixed versions
| 0.23.0 |
Sources
- osv: GHSA-crhg-xgrg-vvcc
- https://github.com/curveball/a12n-server/security/advisories/GHSA-crhg-xgrg-vvcc
- https://nvd.nist.gov/vuln/detail/CVE-2016-20018
- https://github.com/knex/knex/issues/1227
- https://github.com/curveball/a12n-server/commit/f4acd7549043e6e2b8917b77a50dce0756a922cc
- https://github.com/curveball/a12n-server
- https://github.com/curveball/a12n-server/releases/tag/v0.23.0
- https://www.ghostccamm.com/blog/knex_sqli
published · modified · JSON