Lucene search

GitHub Advisory DatabaseGHSA-RWHX-6HX7-PQC8

HistorySep 22, 2023 - 9:30 p.m.

SQL injection in jeecgboot

2023-09-2221:30:23

CWE-89

GitHub Advisory Database

github.com

sql injection

jeecgboot

remote attacker

arbitrary code

crafted request

vulnerability

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

38.9%

JSON

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

Affected configurations

Vulners

Node

trusted_boot_projecttrusted_bootRange≤3.5.3

CPENameOperatorVersion
org.jeecgframework.boot:jeecg-boot-commonle3.5.3

CPE	Name	Operator	Version
	org.jeecgframework.boot:jeecg-boot-common	le	3.5.3

References

github.com/advisories/GHSA-rwhx-6hx7-pqc8

github.com/jeecgboot/jeecg-boot/commit/473875a9d261780a3400cf6f8260ca441b768ed1

github.com/jeecgboot/jeecg-boot/commit/56e81fbf7bce11d2762b691f5d965b2265be608

github.com/jeecgboot/jeecg-boot/commit/87677df925e55e51233bf740433b30a751fc7705

github.com/Zone1-Z/CVE-2023-40989/blob/main/CVE-2023-40989

nvd.nist.gov/vuln/detail/CVE-2023-40989

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

38.9%

JSON

Related for GHSA-RWHX-6HX7-PQC8