Lucene search

GitHub Advisory DatabaseGHSA-4J2X-V3MR-467M

HistoryNov 25, 2022 - 6:30 p.m.

Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString

2022-11-2518:30:25

CWE-89

GitHub Advisory Database

github.com

jeecg-boot

sql injection

updatenullbyemptystring

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.3%

JSON

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.

Affected configurations

Vulners

Node

org.jeecgframework.bootjeecg-boot-commonRange<3.4.4

VendorProductVersionCPE
org.jeecgframework.bootjeecg-boot-common*cpe:2.3:a:org.jeecgframework.boot:jeecg-boot-common:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.jeecgframework.boot	jeecg-boot-common	*	cpe:2.3:a:org.jeecgframework.boot:jeecg-boot-common::::::::

References

github.com/advisories/GHSA-4j2x-v3mr-467m

github.com/jeecgboot/jeecg-boot/commit/8632a835c23f558dfee3584d7658cc6a13ccec6f

github.com/jeecgboot/jeecg-boot/commit/958cf01649e67c79887c21f9c0ada42b552b7ee3

github.com/jeecgboot/jeecg-boot/issues/4127

nvd.nist.gov/vuln/detail/CVE-2022-45207

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.3%

JSON

Related for GHSA-4J2X-V3MR-467M