7 matches found
GHSA-F598-MFPV-GMFX Sequelize - Default support for “raw attributes” when using parentheses
Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...
Sequelize - Default support for “raw attributes” when using parentheses
Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL ts User.findAll attributes: 'countid', 'count' ; Produced sql SELECT countid AS "count" FROM "users" Patches This feature was deprecated i...
@24hr/content-next (>=1.0.0, <=2.1.17-alpha), @24hr/natswrapper (>=1.0.0, <=1.0.20) +276 more potentially affected by CVE-2023-22578 via sequelize (>=6.0.0-beta.4, <=6.28.2)
sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.3.2 and more Source cves: CVE-2023-22578 Source advisory: OSV:GHSA-F598-MFPV-GMFX...
CVE-2023-22578
CVE-2023-22578 affects the Sequelize JavaScript ORM. The issue is caused by improper attribute filtering, enabling a remote attacker to execute SQL injections via crafted queries that can view, add, modify, or delete data in the back-end database. Documented impacts in the IBM/Red Hat/OSS advisor...
CVE-2023-22578 Sequalize - Default support for “raw attributes” when using parentheses
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...
