CVE-2023-25813

2023-02-2219:15:11

CWE-89

[email protected]

web.nvd.nist.gov

node.js

orm

sequelize

sql injection

nvd

upgrade

security advisory

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.5%

JSON

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the replacements and the where option in the same query.

Affected configurations

Vulners

NVD

Node

sequelizesequelizeRange<6.19.1

CPENameOperatorVersion
sequelizejs:sequelizesequelizejs sequelizelt6.19.1

CPE	Name	Operator	Version
sequelizejs:sequelize	sequelizejs sequelize	lt	6.19.1

CNA Affected

[
  {
    "vendor": "sequelize",
    "product": "sequelize",
    "versions": [
      {
        "version": "< 6.19.1",
        "status": "affected"
      }
    ]
  }
]