Lucene search

[email protected]CVE-2024-5523

HistoryMay 31, 2024 - 8:15 a.m.

CVE-2024-5523

2024-05-3108:15:08

CWE-89

[email protected]

web.nvd.nist.gov

cve-2024-5523

sql injection

astrotalks

authenticated user

database retrieval

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

SQL injection vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability could allow an authenticated local user to send a specially crafted SQL query to the ‘searchString’ parameter and retrieve all information stored in the database.

Affected configurations

Vulners

Node

astrotalksastrotalksRange≤03/10/2023

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Astrotalks",
    "vendor": "Astrotalks",
    "versions": [
      {
        "status": "affected",
        "version": "03/10/2023",
        "versionType": "custom"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-astrotalks

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2024-5523

cvelist1 nvd1