What is the CVSS score of CVE-2023-22579?

CVE-2023-22579 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2023-22579?

Yes, a patch is available for CVE-2023-22579. Update the affected software to the latest version immediately.

Sequelize CVE-2023-22579

HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2023-02-16 csirt@divd.nl

Memory Corruption Code Injection Sequelize Sequelizejs

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-843 ASVS 5.0 V15 - Secure Coding and Architecture Type safety enforcement MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 8.8 (HIGH). Attack characteristics: network attack vector, low complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived	A remote attacker could execute arbitrary code by exploiting type confusion in the application by sending crafted requests to the affected application.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict type checking, use type-safe languages, validate object types before operations.

Affected Packages

npm @sequelize/core fix: 7.0.0-alpha.20

npm sequelize fix: 6.28.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Access of Resource Using Incompatible Type (Type Confusion) (CWE-843), which allows attackers to execute arbitrary code by exploiting type confusion in the application. Due to improper parameter filtering in the sequalize js library, can a attacker peform injection. Affected products include: Sequelizejs Sequelize.

Know when Sequelize gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

Threat Intelligence Overview

EPSS Score

0.8%

Top 47% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)NVD

cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6:*:*:*:node.js:*:*

cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7:*:*:*:node.js:*:*

+ 6 more

More in Sequelize

View all

CVE-2026-69240 CRITICAL Act Now POC

9.8 Aug 03

SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL th

CVE-2023-25813 CRITICAL Act Now POC

9.8 Feb 22

Sequelize is a Node.js ORM tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no auth

CVE-2019-10749 CRITICAL Act Now POC

9.8 Oct 29

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly

CVE-2019-10748 CRITICAL Act Now POC

9.8 Oct 29

Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not bei

CVE-2019-10752 CRITICAL Act Now POC

9.8 Oct 17

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helpe

CVE-2015-1369 HIGH This Week POC

7.5 Jan 27

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL c

CVE-2023-22578 CRITICAL Act Now

9.8 Feb 16

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections. Rated critical sev

CVE-2026-30951 HIGH This Week POC

7.5 Mar 10

SQL injection in Sequelize prior to version 6.37.8 allows unauthenticated attackers to execute arbitrary SQL queries and

CVE-2023-22580 HIGH This Week

7.5 Feb 16

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclos

CVE-2019-11069 HIGH This Week

7.5 Apr 10

Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. Rated high severity

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all

CVE-2011-0611 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2017-8291 HIGH POC

7.8

CVE-2016-7201 HIGH POC

8.8

CVE-2017-0037 HIGH POC

8.1

CVE-2019-0752 HIGH POC

7.5

CVE-2017-5070 HIGH POC

8.8

CVE-2023-3079 HIGH POC

8.8

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

References

Advisories & patches

REF https://csirt.divd.nl/CVE-2023-22579 REF https://csirt.divd.nl/DIVD-2022-00020/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back