Lucene search

[email protected]NVD:CVE-2023-40954

HistoryDec 15, 2023 - 1:15 a.m.

CVE-2023-40954

2023-12-1501:15:07

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

grzegorz marczynski

dynamic progress bar

remote attacker

privilege escalation

recency parameter

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

27.4%

JSON

A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.

Affected configurations

NVD

Node

gmarczynskidynamic_progress_barRange11.0–11.0.2odoo

gmarczynskidynamic_progress_barRange12.0–12.0.2odoo

gmarczynskidynamic_progress_barRange13.0–13.0.2odoo

gmarczynskidynamic_progress_barRange14.0–14.0.2.1odoo

gmarczynskidynamic_progress_barRange15.0–15.0.2odoo

gmarczynskidynamic_progress_barRange16.0–16.0.2.1odoo

References

github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f

github.com/luvsn/OdZoo/tree/main/exploits/web_progress

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

27.4%

JSON

Related for NVD:CVE-2023-40954

osv1 cve1 prion1 cvelist1