feathers-sequelize vulnerable to SQL injection due to improper parameter filtering

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-29822 · ADVISORY
• feathersjs-ecosystem/feathers-sequelize commit 0f2d85f · WEB
• csirt.divd.nl/CVE-2022-29822 · WEB
• csirt.divd.nl/DIVD-2022-00020 · WEB
• csirt.divd.nl/cases/DIVD-2022-00020 · WEB
• csirt.divd.nl/cves/CVE-2022-29822 · WEB
• feathersjs-ecosystem/feathers-sequelize · PACKAGE
• csirt.divd.nl/CVE-2022-29822 · Third Party Advisory

feathers-sequelize のその他の脆弱性

• CVE-2022-2422緊急 9.8Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in c…
• CVE-2022-29823緊急 9.8Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote…