Improper Input Validation Affecting cruddl package, versions >=1.1.0 <2.7.0>=3.0.0 <3.0.1


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.22% (62nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-CRUDDL-3019825
  • published9 Sept 2022
  • disclosed9 Sept 2022
  • creditUnknown

Introduced: 9 Sep 2022

CVE-2022-36084  (opens in a new tab)
CWE-20  (opens in a new tab)
CWE-943  (opens in a new tab)

How to fix?

Upgrade cruddl to version 2.7.0, 3.0.1 or higher.

Overview

cruddl is a npm version Build Status [![Package Quality](https://npm.

Affected versions of this package are vulnerable to Improper Input Validation. If it is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Note: Schemas that do not use @flexSearchFulltext are not affected, and an attacker needs to have READ permission to at least one root entity type that has @flexSearchFulltext enabled.

CVSS Scores

version 3.1