Lucene search

GitHub Advisory DatabaseGHSA-RWHX-6HX7-PQC8

HistorySep 22, 2023 - 9:30 p.m.

SQL injection in jeecgboot

2023-09-2221:30:23

CWE-89

GitHub Advisory Database

github.com

sql injection

jeecgboot

remote attacker

arbitrary code

crafted request

vulnerability

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

51.2%

JSON

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

Affected configurations

Vulners

Node

org.jeecgframework.bootjeecg-boot-commonRange≤3.5.3

VendorProductVersionCPE
org.jeecgframework.bootjeecg-boot-common*cpe:2.3:a:org.jeecgframework.boot:jeecg-boot-common:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.jeecgframework.boot	jeecg-boot-common	*	cpe:2.3:a:org.jeecgframework.boot:jeecg-boot-common::::::::

References

github.com/advisories/GHSA-rwhx-6hx7-pqc8

github.com/jeecgboot/jeecg-boot/commit/473875a9d261780a3400cf6f8260ca441b768ed1

github.com/jeecgboot/jeecg-boot/commit/56e81fbf7bce11d2762b691f5d965b2265be608

github.com/jeecgboot/jeecg-boot/commit/87677df925e55e51233bf740433b30a751fc7705

github.com/Zone1-Z/CVE-2023-40989/blob/main/CVE-2023-40989

nvd.nist.gov/vuln/detail/CVE-2023-40989

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

51.2%

JSON

Related for GHSA-RWHX-6HX7-PQC8