Lucene search

GoogleOSV:CVE-2023-40954

HistoryDec 15, 2023 - 1:15 a.m.

CVE-2023-40954

2023-12-1501:15:07

Google

osv.dev

sql injection

grzegorz marczynski dynamic progress bar

remote attacker

gain privileges

recency parameter

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.3%

JSON

A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.

CPENameOperatorVersion
odoo-web-progresseq15.20.0.1
odoo-web-progresseq11.0.1.1
odoo-web-progresseq16.2.1
odoo-web-progresseq12.0.1.1
odoo-web-progresseq11.0.1.0
odoo-web-progresseq12.0.1.2
odoo-web-progresseq11.0.1.2
odoo-web-progresseq12.0.1.0

Name	Operator	Version
odoo-web-progress	eq	15.20.0.1
odoo-web-progress	eq	11.0.1.1
odoo-web-progress	eq	16.2.1
odoo-web-progress	eq	12.0.1.1
odoo-web-progress	eq	11.0.1.0
odoo-web-progress	eq	12.0.1.2
odoo-web-progress	eq	11.0.1.2
odoo-web-progress	eq	12.0.1.0

References

github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f

github.com/luvsn/OdZoo/tree/main/exploits/web_progress

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.3%

JSON

Related for OSV:CVE-2023-40954