CVE-2023-22580: Sequalize - Bad query filtering leading to SQL errors

Q: What is CVE-2023-22580?

CVE-2023-22580 is a vulnerability in the Sequelize.js library that allows for sensitive information disclosure due to improper input filtering.

Q: How severe is CVE-2023-22580?

CVE-2023-22580 has a severity rating of 7.5 (high).

Q: Which software versions are affected by CVE-2023-22580?

The affected software versions include Sequelize.js 6.28.1 and Sequelize.js 7.0.0-alpha1 to 7.0.0-oc_test_4 in Node.js.

Q: How can malicious queries lead to sensitive information disclosure in Sequelize.js?

Malicious queries can lead to sensitive information disclosure in Sequelize.js due to the improper input filtering, allowing attackers to manipulate the database queries and access sensitive data.

Q: Where can I find more information about CVE-2023-22580?

You can find more information about CVE-2023-22580 at the following links: [Link 1](https://csirt.divd.nl/CVE-2023-22580), [Link 2](https://csirt.divd.nl/DIVD-2022-00020/)

Published Feb 16, 2023

Updated

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Affected Software

26 affected components

Sequelizejs Sequelize Node.js<6.28.1

Sequelizejs Sequelize Node.js=7.0.0-alpha1

Sequelizejs Sequelize Node.js=7.0.0-alpha10

Sequelizejs Sequelize Node.js=7.0.0-alpha11

Sequelizejs Sequelize Node.js=7.0.0-alpha12

Sequelizejs Sequelize Node.js=7.0.0-alpha13

Sequelizejs Sequelize Node.js=7.0.0-alpha14

Sequelizejs Sequelize Node.js=7.0.0-alpha15

Sequelizejs Sequelize Node.js=7.0.0-alpha16

Sequelizejs Sequelize Node.js=7.0.0-alpha17

Sequelizejs Sequelize Node.js=7.0.0-alpha18

Sequelizejs Sequelize Node.js=7.0.0-alpha19

Sequelizejs Sequelize Node.js=7.0.0-alpha2

Sequelizejs Sequelize Node.js=7.0.0-alpha2.1

Sequelizejs Sequelize Node.js=7.0.0-alpha2.2

Sequelizejs Sequelize Node.js=7.0.0-alpha3

Sequelizejs Sequelize Node.js=7.0.0-alpha4

Sequelizejs Sequelize Node.js=7.0.0-alpha5

Sequelizejs Sequelize Node.js=7.0.0-alpha6

Sequelizejs Sequelize Node.js=7.0.0-alpha7

Sequelizejs Sequelize Node.js=7.0.0-alpha8

Sequelizejs Sequelize Node.js=7.0.0-alpha9

Sequelizejs Sequelize Node.js=7.0.0-oc_test_1

Sequelizejs Sequelize Node.js=7.0.0-oc_test_2

Sequelizejs Sequelize Node.js=7.0.0-oc_test_3

Sequelizejs Sequelize Node.js=7.0.0-oc_test_4

Event History

Feb 16, 2023

CVE Published

via MITRE·02:11 PM

Data Sourced

via MITRE·02:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-22580?

CVE-2023-22580 is a vulnerability in the Sequelize.js library that allows for sensitive information disclosure due to improper input filtering.

How severe is CVE-2023-22580?

CVE-2023-22580 has a severity rating of 7.5 (high).

Which software versions are affected by CVE-2023-22580?

The affected software versions include Sequelize.js 6.28.1 and Sequelize.js 7.0.0-alpha1 to 7.0.0-oc_test_4 in Node.js.

How can malicious queries lead to sensitive information disclosure in Sequelize.js?

Malicious queries can lead to sensitive information disclosure in Sequelize.js due to the improper input filtering, allowing attackers to manipulate the database queries and access sensitive data.

Where can I find more information about CVE-2023-22580?