CVE-2022-29823 | Feather-Sequalize cleanQuery method uses insecure recursive … | CVSS 10.0 CRITICAL

Description

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

Metadata

CVE ID: CVE-2022-29823
State: PUBLISHED
Assigner: DIVD
Reserved: 2022-04-27 00:00 UTC
Published: 2022-10-25 00:00 UTC
Last updated: 2025-03-11 13:39 UTC
Primary CWE: CWE-1321
CWE-1321: Improperly Controlled Modification of Object Proto…
Vendor / Product: Feather js / Feathers-Sequalize
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
Feather js	Feathers-Sequalize	—	6.x < 6.3.4

Weakness (CWE)

CWE	Source	Description
CWE-1321	cna	CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ("Prototype Pollution")

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)