Lucene search

MitreCVE-2023-24163

HistoryJan 31, 2023 - 4:15 p.m.

CVE-2023-24163

2023-01-3116:15:09

CWE-89

mitre

web.nvd.nist.gov

cve

2023

24163

sql injection

dromara hutool

v5.8.11

nvd

vulnerability

arbitrary code

aviator template engine

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.

Affected configurations

Nvd

Node

hutoolhutoolRange<5.8.21

VendorProductVersionCPE
hutoolhutool*cpe:2.3:a:hutool:hutool:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hutool	hutool	*	cpe:2.3:a:hutool:hutool::::::::

References

gitee.com/dromara/hutool/issues/I6AJWJ#note_15801868

gitee.com/dromara/hutool/issues/I6AJWJ#note_20057806_link

github.com/dromara/hutool/issues/3149

github.com/dromara/hutool/releases/tag/5.8.21

github.com/google/osv.dev/issues/2195

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

Related for CVE-2023-24163