CVE-2023-22578

high-risk
Published 2023-02-16

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.

Do I need to act?

-
0.18% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: d3f5b5a65e297f4b6861e6a6ce335a9830b28781
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize
Sequelize

Affected Vendors

Sequelizejs

References (4)

Third Party Advisory https://csirt.divd.nl/CVE-2023-22578
Third Party Advisory https://csirt.divd.nl/DIVD-2022-00020/
Third Party Advisory https://csirt.divd.nl/CVE-2023-22578
Third Party Advisory https://csirt.divd.nl/DIVD-2022-00020/
55
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 1/34 · Minimal
Exposure 21/34 · High