Is CVE-2023-22580 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-22580 being exploited in the wild.

How severe is CVE-2023-22580?

Low severity, with a CVSS score of 3.1, published 16 February 2023.

Which products and versions are affected?

@sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.28.1.

Is there a fix for CVE-2023-22580?

Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-22580 attacked?

It is attacked over the network.

Am I affected by CVE-2023-22580?

Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-22580: Sequelize information disclosure via improper input filtering

CVE-2023-22580 · Severity: low · CVSS 3.1 · Published 2023-02-16

Sequelize is a popular Node.js ORM library used to interact with databases in web applications. A vulnerability in input filtering allows attackers to craft malicious queries that expose sensitive database information without requiring authentication or user interaction. This could lead to unauthorized data leakage affecting customer privacy and application security.

Technologies: @sequelize/core (npm), sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2023-22580 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-22580 being exploited in the wild.
How severe is CVE-2023-22580?: Low severity, with a CVSS score of 3.1, published 16 February 2023.
Which products and versions are affected?: @sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.28.1.
Is there a fix for CVE-2023-22580?: Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-22580 attacked?: It is attacked over the network.
Am I affected by CVE-2023-22580?: Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later
```
npm install @sequelize/core@7.0.0-alpha.20
```
sequelize (npm): upgrade to 6.28.1 or later
```
npm install sequelize@6.28.1
```

Technical details

The vulnerability stems from improper input filtering in Sequelize's query handling mechanism, specifically in the `where` clause processing (CWE-200: Information Exposure). Attackers can supply specially crafted query parameters to bypass intended filters and access sensitive database records. The attack requires network access to the application but no authentication; it can be triggered through standard application queries. The vulnerability was fixed in Sequelize v6.28.1 and v7.0.0-alpha.20, with patches implemented in pull requests #15375 and #15699 that enforce stricter validation on `where` clause values.

Affected products

Sequelize sequelize All versions before 6.28.1
Sequelize @sequelize/core All versions before 7.0.0-alpha.20

Identifiers

CVE-2023-22580
GHSA-8c25-f3mj-v6h8

Timeline

2023-02-16: disclosed
2023-02-16: patched: Fixes released in v6.28.1 and v7.0.0-alpha.20

References

https://github.com/sequelize/sequelize/pull/15375

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.