GHSA-8mwq-mj73-qv68
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8mwq-mj73-qv68
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-8mwq-mj73-qv68/GHSA-8mwq-mj73-qv68.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-8mwq-mj73-qv68
- Withdrawn
- 2023-02-24T18:48:34Z
- Published
- 2023-02-16T15:30:28Z
- Modified
- 2023-02-24T18:48:34Z
- Severity
-
- 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements
- Details
-
Duplicate advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f598-mfpv-gmfx. This link is maintained to preserve external references.
Original Description
Due to improper attribute filtering in the sequelize js library, an attacker can peform SQL injections. This issue can be mitigated by not accepting untrusted input.
- Database specific
{ "cwe_ids": [ "CWE-790" ], "github_reviewed": true, "github_reviewed_at": "2023-02-22T23:16:24Z", "nvd_published_at": "2023-02-16T15:15:00Z", "severity": "CRITICAL" }- References
Affected packages
npm / @sequelize/core
Package
- Name
- @sequelize/core
- View open source insights on deps.dev
- Purl
- pkg:npm/%40sequelize/core
npm / sequelize
Package
- Name
- sequelize
- View open source insights on deps.dev
- Purl
- pkg:npm/sequelize