GitHub Advisoryadvisory · npm
GHSA-8c25-f3mj-v6h8 Sequelize information disclosure vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2023-22580
- Ecosystem
- npm
- Packages
- sequelize, @sequelize/core
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-02-22
Affected packages
• npm sequelize: < 6.28.1 → fixed in 6.28.1
• npm @sequelize/core: < 7.0.0-alpha.20 → fixed in 7.0.0-alpha.20
Description
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
Related
Alias · CVE (1)
- CVE-2023-22580 Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-22580 advisory
- https://github.com/sequelize/sequelize/pull/15375 web
- https://github.com/sequelize/sequelize/pull/15699 web
- https://csirt.divd.nl/CVE-2023-22580 web
- https://csirt.divd.nl/DIVD-2022-00020 web
- https://github.com/sequelize/sequelize package
- https://github.com/sequelize/sequelize/releases/tag/v6.28.1 web
- https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20 web