guillerbr / api-sequelize-node Goto Github PK

Vulnerable Library - sequelize-5.19.0.tgz

Multi dialect ORM for Node.JS

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

• ❌ sequelize-5.19.0.tgz (Vulnerable Library)

Vulnerability Details

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.

Publish Date: 2023-02-16

URL: CVE-2023-22578

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-8mwq-mj73-qv68

Release Date: 2023-02-16

Fix Resolution: @sequelize/core - 7.0.0-alpha.20

Vulnerable Library - moment-timezone-0.5.26.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.26.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/package.json

Dependency Hierarchy:

• sequelize-5.19.0.tgz (Root Library)
  • ❌ moment-timezone-0.5.26.tgz (Vulnerable Library)

Vulnerability Details

Command Injection in moment-timezone before 0.5.35.

Publish Date: 2022-08-30

URL: WS-2022-0280

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-56x4-j7p9-fcf9

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (sequelize): 6.16.1

Vulnerable Library - moment-2.24.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.24.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• sequelize-5.19.0.tgz (Root Library)
  • ❌ moment-2.24.0.tgz (Vulnerable Library)

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution (moment): 2.29.4

Direct dependency fix Resolution (sequelize): 6.16.1

Vulnerable Library - sequelize-5.19.0.tgz

Multi dialect ORM for Node.JS

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

• ❌ sequelize-5.19.0.tgz (Vulnerable Library)

Vulnerability Details

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

Publish Date: 2023-02-16

URL: CVE-2023-22579

CVSS 3 Score Details (9.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-16

Fix Resolution: 6.28.1

Vulnerable Library - moment-2.24.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.24.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• sequelize-5.19.0.tgz (Root Library)
  • ❌ moment-2.24.0.tgz (Vulnerable Library)

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (sequelize): 6.16.1

Vulnerable Library - moment-timezone-0.5.26.tgz

Parse and display moments in any timezone.

Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.26.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/package.json

Dependency Hierarchy:

• sequelize-5.19.0.tgz (Root Library)
  • ❌ moment-timezone-0.5.26.tgz (Vulnerable Library)

Vulnerability Details

Cleartext Transmission of Sensitive Information in moment-timezone

Publish Date: 2022-08-30

URL: WS-2022-0284

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-v78c-4p63-2j6c

Release Date: 2022-08-30

Fix Resolution (moment-timezone): 0.5.35

Direct dependency fix Resolution (sequelize): 6.16.1

Vulnerable Library - sequelize-5.19.0.tgz

Multi dialect ORM for Node.JS

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

• ❌ sequelize-5.19.0.tgz (Vulnerable Library)

Vulnerability Details

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Publish Date: 2023-02-16

URL: CVE-2023-22580

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-16

Fix Resolution: 6.28.1

Vulnerable Library - sequelize-5.19.0.tgz

Multi dialect ORM for Node.JS

Library home page: https://registry.npmjs.org/sequelize/-/sequelize-5.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sequelize/package.json

Dependency Hierarchy:

• ❌ sequelize-5.19.0.tgz (Vulnerable Library)

Vulnerability Details

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the replacements and the where option in the same query.

Publish Date: 2023-02-22

URL: CVE-2023-25813

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25813

Release Date: 2023-02-22

Fix Resolution: 6.19.1