Lucene search

GoogleOSV:CVE-2023-38905

HistoryAug 17, 2023 - 7:15 p.m.

CVE-2023-38905

2023-08-1719:15:12

Google

osv.dev

sql injection

jeecg-boot

vulnerability

denial of service

benchmark

pg_sleep

dbms_lock.sleep

waitfor

decode

dbms_pipe.receive_message

software

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.

CPENameOperatorVersion
jeecg-booteq2.1.2
jeecg-booteq3.4.4
jeecg-booteq2.1.4
jeecg-booteq3.3.0
jeecg-booteq3.4.3
jeecg-booteq3.1.0
jeecg-booteq2.1.3
jeecg-booteq2.3
jeecg-booteq3.4.0
jeecg-booteq2.2.1

Name	Operator	Version
jeecg-boot	eq	2.1.2
jeecg-boot	eq	3.4.4
jeecg-boot	eq	2.1.4
jeecg-boot	eq	3.3.0
jeecg-boot	eq	3.4.3
jeecg-boot	eq	3.1.0
jeecg-boot	eq	2.1.3
jeecg-boot	eq	2.3
jeecg-boot	eq	3.4.0
jeecg-boot	eq	2.2.1

Rows per page:

1-10 of 281

References

gist.github.com/wealeson1/e24fc8575f4e051320d69e9a75080642

github.com/jeecgboot/jeecg-boot/issues/4737

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for OSV:CVE-2023-38905