CVE-2022-29823

moderate-risk

Published 2022-10-26

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

Do I need to act?

3.8% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: 0f2edef8593f5e81195d47f89931f147a96664e7

CVSS 10.0/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Feathers-Sequelize

Affected Vendors

Feathersjs

References (4)

Third Party Advisory https://csirt.divd.nl/CVE-2022-29823/

Third Party Advisory https://csirt.divd.nl/DIVD-2022-00020

Third Party Advisory https://csirt.divd.nl/CVE-2022-29823/

Third Party Advisory https://csirt.divd.nl/DIVD-2022-00020

/ 100

moderate-risk

Severity 33/34 · Critical

Exploitability 7/34 · Low

Exposure 5/34 · Minimal