Lucene search

GitHub_MCVE-2023-30554

HistoryApr 19, 2023 - 12:15 a.m.

CVE-2023-30554

2023-04-1900:15:09

CWE-89

GitHub_M

web.nvd.nist.gov

archery

sql injection

database security

vulnerability

nvd

ghsl-2022-103

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the sql_api/api_workflow.py endpoint ExecuteCheck which passes unfiltered input to the explain_check method in sql/engines/oracle.py. User input coming from the db_name parameter value in the api_workflow.py ExecuteCheck endpoint is passed through the oracle.py execute_check method and to the explain_check method for execution. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as GHSL-2022-103.

Affected configurations

Nvd

Vulners

Node

archerydmsarcheryMatch1.9.0

VendorProductVersionCPE
archerydmsarchery1.9.0cpe:2.3:a:archerydms:archery:1.9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
archerydms	archery	1.9.0	cpe:2.3:a:archerydms:archery:1.9.0:::::::*

CNA Affected

[
  {
    "vendor": "hhyo",
    "product": "Archery",
    "versions": [
      {
        "version": "<= 1.9.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/hhyo/Archery/security/advisories/GHSA-3p43-89m6-7x5w

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

Related for CVE-2023-30554