Lucene search

GoogleOSV:CVE-2023-52096

HistoryDec 26, 2023 - 11:15 p.m.

CVE-2023-52096

2023-12-2623:15:07

Google

osv.dev

cve-2023-52096

invalid timestamps

sql exception

integrity

transaction records

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

30.8%

JSON

SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications, and may undermine the integrity of transaction records.

References

github.com/steve-community/ocpp-jaxb/compare/0.0.7...0.0.8

github.com/steve-community/ocpp-jaxb/issues/13

github.com/steve-community/steve/issues/1292

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

Low

EPSS

0.001

Percentile

30.8%

JSON

Related for OSV:CVE-2023-52096