Lucene search

MitreCVE-2023-48049

HistoryDec 15, 2023 - 12:15 a.m.

CVE-2023-48049

2023-12-1500:15:42

CWE-89

mitre

web.nvd.nist.gov

cybrosys techno solutions

website blog

sql injection

vulnerability

security

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.9%

JSON

A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.

Affected configurations

Nvd

Node

cybrosyswebsite_blog_searchRange13.0–13.0.1.0.1odoo

VendorProductVersionCPE
cybrosyswebsite_blog_search*cpe:2.3:a:cybrosys:website_blog_search:*:*:*:*:*:odoo:*:*

Vendor	Product	Version	CPE
cybrosys	website_blog_search	*	cpe:2.3:a:cybrosys:website_blog_search::::::odoo::*

References

github.com/luvsn/OdZoo/tree/main/exploits/website_search_blog

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

38.9%

JSON

Related for CVE-2023-48049