Lucene search

GitHub Advisory DatabaseGHSA-6W89-C65W-JX2C

HistoryJan 19, 2023 - 6:30 p.m.

Jeecg-boot is vulnerable to SQL injection

2023-01-1918:30:21

CWE-89

GitHub Advisory Database

github.com

jeecg-boot v3.4.4 sql injection patch vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

51.8%

JSON

Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. A patch was released in commit 0fc374.

Affected configurations

Vulners

Node

phpbbjournals_system_moduleRange≤3.4.4

trusted_boot_projecttrusted_bootRange≤3.4.4

CPENameOperatorVersion
org.jeecgframework.boot:jeecg-module-systemle3.4.4
org.jeecgframework.boot:jeecg-boot-base-corele3.4.4

CPE	Name	Operator	Version
	org.jeecgframework.boot:jeecg-module-system	le	3.4.4
	org.jeecgframework.boot:jeecg-boot-base-core	le	3.4.4

References

github.com/advisories/GHSA-6w89-c65w-jx2c

github.com/jeecgboot/jeecg-boot/commit/0fc374de4745eac52620eeb8caf6a7b76127529a

github.com/jeecgboot/jeecg-boot/issues/4393

nvd.nist.gov/vuln/detail/CVE-2022-47105

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

51.8%

JSON

Related for GHSA-6W89-C65W-JX2C