CVE-2023-22578: Sequalize - Default support for “raw attributes” when using parentheses
Published Feb 16, 2023
·Updated
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
Affected Software
26 affected components
Sequelizejs Sequelize Node.js<6.29.0
Sequelizejs Sequelize Node.js=7.0.0-alpha1
Sequelizejs Sequelize Node.js=7.0.0-alpha10
Sequelizejs Sequelize Node.js=7.0.0-alpha11
Sequelizejs Sequelize Node.js=7.0.0-alpha12
Sequelizejs Sequelize Node.js=7.0.0-alpha13
Sequelizejs Sequelize Node.js=7.0.0-alpha14
Sequelizejs Sequelize Node.js=7.0.0-alpha15
Sequelizejs Sequelize Node.js=7.0.0-alpha16
Sequelizejs Sequelize Node.js=7.0.0-alpha17
Sequelizejs Sequelize Node.js=7.0.0-alpha18
Sequelizejs Sequelize Node.js=7.0.0-alpha19
Sequelizejs Sequelize Node.js=7.0.0-alpha2
Sequelizejs Sequelize Node.js=7.0.0-alpha2.1
Sequelizejs Sequelize Node.js=7.0.0-alpha2.2
Sequelizejs Sequelize Node.js=7.0.0-alpha3
Sequelizejs Sequelize Node.js=7.0.0-alpha4
Sequelizejs Sequelize Node.js=7.0.0-alpha5
Sequelizejs Sequelize Node.js=7.0.0-alpha6
Sequelizejs Sequelize Node.js=7.0.0-alpha7
Sequelizejs Sequelize Node.js=7.0.0-alpha8
Sequelizejs Sequelize Node.js=7.0.0-alpha9
Sequelizejs Sequelize Node.js=7.0.0-oc_test_1
Sequelizejs Sequelize Node.js=7.0.0-oc_test_2
Sequelizejs Sequelize Node.js=7.0.0-oc_test_3
Sequelizejs Sequelize Node.js=7.0.0-oc_test_4
Event History
Feb 16, 2023
CVE Published
via MITRE·02:11 PM
Data Sourced
via MITRE·02:11 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-22578?
CVE-2023-22578 refers to a vulnerability in the Sequelize.js library that allows attackers to perform SQL injections due to improper attribute filtering.
2
How severe is CVE-2023-22578?
CVE-2023-22578 has a severity rating of 9.8, which is classified as critical.
3
Which software versions are affected by CVE-2023-22578?
The affected software versions include Sequelize.js versions up to and including 6.29.0, as well as version 7.0.0-alpha1 to 7.0.0-alpha19.
4
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2023-22578?
The CWE IDs associated with CVE-2023-22578 are CWE-89 (SQL Injection) and CWE-790 (Allocation of Resources Without Limits or Throttling).
5
Where can I find more information about CVE-2023-22578?
You can find more information about CVE-2023-22578 at the following references: [1] [2]