CVE-2023-22580 - CVE House

Status published Medium CVE-2023-22580

Sequalize - Bad query filtering leading to SQL errors

5.3 CVSS

Vulnerability Description

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22580

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thomas Rinsma (Codean)
Kevin Valk (Codean)
Victor Pasman (DIVD)
Frank Breedijk (DIVD)

References

More from Feathers-Sequalize

View All →

CVE-2023-22579

Sequalize - Unsafe fall-through in getWhereConditions

Critical 9.9

CVE-2023-22578

Sequalize - Default support for “raw attributes” when using parentheses

Critical 10

Affected Vendor

Feathers-Sequalize

View all reports →

Affected Software

Sequelize.js

Vulnerable Versions:

<v7.0.0-alpha.20

Timeline

Official Publish: February 16th, 2023

Last Modified: April 1st, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

Collection

T1005 Data from Local System