CVE-2023-22580

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://csirt.divd.nl/CVE-2023-22580	Third Party Advisory
https://csirt.divd.nl/DIVD-2022-00020/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sequelizejs:sequelize::::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3::::node.js::*
	cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4::::node.js::*

History

24 Feb 2023, 19:52

Type	Values Removed	Values Added
CWE		CWE-200
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(MISC) https://csirt.divd.nl/DIVD-2022-00020/ -~~	(MISC) https://csirt.divd.nl/DIVD-2022-00020/ - Third Party Advisory
References	~~(MISC) https://csirt.divd.nl/CVE-2023-22580 -~~	(MISC) https://csirt.divd.nl/CVE-2023-22580 - Third Party Advisory
CPE		cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2::::node.js::* cpe:2.3:a:sequelizejs:sequelize::::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14::::node.js::* cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10::::node.js::*
First Time		Sequelizejs sequelize Sequelizejs

16 Feb 2023, 15:48

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-02-16 15:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-22580

Mitre link : CVE-2023-22580

CVE.ORG link : CVE-2023-22580

JSON object : View

Products Affected

sequelizejs

sequelize

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

7.5 /10