CVE-2023-32697 Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

2023-05-2322:45:10

CWE-94

GitHub_M

www.cve.org

cve-2023-32697

sqlite-jdbc

remote code execution

jdbc url

version 3.41.2.2

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.015

Percentile

87.0%

JSON

SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

CNA Affected

[
  {
    "vendor": "xerial",
    "product": "sqlite-jdbc",
    "versions": [
      {
        "version": ">= 3.6.14.1, < 3.41.2.2",
        "status": "affected"
      }
    ]
  }
]