« Volver al listado

CVE-2022-29823

Estado: ModificadaCrítica (9.8)—

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Feathersjs — Feathers-sequelize

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-29823",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "csirt@divd.nl",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "csirt@divd.nl",
      "affectedData": [
        {
          "vendor": "Feather js",
          "product": "Feathers-Sequalize",
          "versions": [
            {
              "status": "affected",
              "version": "6.x",
              "lessThan": "6.3.4",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-26T10:15:16.190",
  "references": [
    {
      "url": "https://csirt.divd.nl/CVE-2022-29823/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "csirt@divd.nl"
    },
    {
      "url": "https://csirt.divd.nl/DIVD-2022-00020",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "csirt@divd.nl"
    },
    {
      "url": "https://csirt.divd.nl/CVE-2022-29823/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://csirt.divd.nl/DIVD-2022-00020",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "csirt@divd.nl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application."
    },
    {
      "lang": "es",
      "value": "El método cleanQuery de Feather-Sequalize usa una lógica recursiva no segura para filtrar las claves no soportadas del objeto de consulta. Esto resulta en una ejecución de código remota (RCE) con privilegios de la aplicación"
    }
  ],
  "lastModified": "2026-06-17T04:40:46.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:feathersjs:feathers-sequelize:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D774E13F-E66A-4F0B-9AE2-55671506913E",
              "versionEndExcluding": "6.3.4",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "csirt@divd.nl"
}