Lucene search
HistoryDec 15, 2023 - 12:15 a.m.
CVE-2023-48049
cybrosys techno solutions
sql injection
website blog search
remote attacker
arbitrary code
gain privileges
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
38.9%
A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.
Affected configurations
Node
cybrosyswebsite_blog_searchRange13.0–13.0.1.0.1odoo
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cybrosys | website_blog_search | * | cpe:2.3:a:cybrosys:website_blog_search:*:*:*:*:*:odoo:*:* |
Related
cvelist
cvelist
CVE-2023-48049
2023-12-14 00:00:00
cve
cve
CVE-2023-48049
2023-12-15 00:15:42
prion
prion
Sql injection
2023-12-15 00:15:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
38.9%
Related for NVD:CVE-2023-48049