DIVD-2022-00020 - Inproper input validation vulnerabilities identified within Feathers.js
|Feathers.js & Sequalize.js
|6.x < 6.3.4
|If you received a notification of a vulnerability, patch your system with the information provided in this notification.
|28 May 2023 20:52
By leveraging the vulnerabilities, an unauthenticated attacker with network access to the application using Feathers.js and Sequelize.js can perform SQL-injections.
What you can do
We recommend to use the latest version of Feathers.js
What we are doing
- DIVD is currently ensuring that the owners of vulnerable systems are being notified. We do this by scanning for vulnerable hosts, verifying the vulnerability and notifying the owners of these systems. If you receive an email from us regarding this case, the vulnerability has been confirmed.
|23 Mar 2022
|Vulnerability discovered by Thomas Rinsma and Kevin Valk from Codean.
|04 Apr 2022
|Testing by DIVD conforms that the vulnerabilities are still present in the product.
|10 Jun 2022
|Vendor releases new update and asks us to retest vulnerabilities.
|13 Jul 2022
|We confirm vulnerabilities have been fixed.
|25 Oct 2022
|27 May 2023
|Case closed, because we were unable to fingerprint for the vulnerability.