CVE-2023-22580 Sequalize - Bad query filtering leading to SQL errors
Improper input filtering in Sequelize.js allows malicious queries to disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22580?
CVE-2023-22580 is a medium-severity vulnerability in Feathers-Sequalize Sequelize.js, published on 16 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.
Weakness: CWE-200
Which versions are affected by CVE-2023-22580?
4 open source packages ship an affected version, including @sequelize/core and sequelize. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@sequelize/core npm | All versions | 7.0.0-alpha.20 |
@sequelize/core npm | All versions | 7.0.0-alpha.20 |
sequelize npm | All versions | 6.28.1 |
sequelize npm | All versions | 6.28.1 |
Products include Sequelizejs Sequelize.
How do I fix CVE-2023-22580?
Upgrade @sequelize/core to 7.0.0-alpha.20 or later.
Is CVE-2023-22580 being exploited?
There is no known exploitation of CVE-2023-22580 in the wild and no public exploit code.
Other vulnerabilities in Feathers-Sequalize Sequelize.js
Sources
Also known as GHSA-8c25-f3mj-v6h8.