Fluid Attacks Database

Description

Sequelize information disclosure vulnerability Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	@sequelize/core	>=0 <7.0.0-alpha.20	7.0.0-alpha.20
npm	sequelize	>=0 <6.28.1	6.28.1

Aliases

1. CVE-2023-225802. NVD-2023-225803. OSV-2023-225804. GCVE-2023-22580

References

1. https://github.com/sequelize/sequelize/pull/153752. https://github.com/sequelize/sequelize/pull/156993. https://csirt.divd.nl/CVE-2023-225804. https://csirt.divd.nl/DIVD-2022-000205. https://github.com/sequelize/sequelize/releases/tag/v6.28.16. https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.