Lucene search

GitHub Advisory DatabaseGHSA-V87Q-RPWP-QR7Q

HistoryNov 25, 2022 - 6:30 p.m.

Jeecg-boot vulnerable to SQL Injection

2022-11-2518:30:25

CWE-89

GitHub Advisory Database

github.com

jeecg-boot

sql injection

vulnerability

software

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

24.8%

JSON

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.

Affected configurations

Vulners

Node

trusted_boot_projecttrusted_bootRange<3.4.4

CPENameOperatorVersion
org.jeecgframework.boot:jeecg-boot-commonlt3.4.4

CPE	Name	Operator	Version
	org.jeecgframework.boot:jeecg-boot-common	lt	3.4.4

References

github.com/advisories/GHSA-v87q-rpwp-qr7q

github.com/jeecgboot/jeecg-boot/commit/51e2227bfe54f5d67b09411ee9a336750164e73d

github.com/jeecgboot/jeecg-boot/issues/4125

nvd.nist.gov/vuln/detail/CVE-2022-45210

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for GHSA-V87Q-RPWP-QR7Q