Lucene search

GoogleOSV:GHSA-4J2X-V3MR-467M

HistoryNov 25, 2022 - 6:30 p.m.

Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString

2022-11-2518:30:25

Google

osv.dev

jeecg-boot

sql injection

updatenullbyemptystring

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

52.3%

JSON

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.

CPENameOperatorVersion
org.jeecgframework.boot:jeecg-boot-commoneq3.4.2
org.jeecgframework.boot:jeecg-boot-commoneq3.4.3
org.jeecgframework.boot:jeecg-boot-commoneq3.4.0

Name	Operator	Version
org.jeecgframework.boot:jeecg-boot-common	eq	3.4.2
org.jeecgframework.boot:jeecg-boot-common	eq	3.4.3
org.jeecgframework.boot:jeecg-boot-common	eq	3.4.0

References

github.com/jeecgboot/jeecg-boot

github.com/jeecgboot/jeecg-boot/commit/8632a835c23f558dfee3584d7658cc6a13ccec6f

github.com/jeecgboot/jeecg-boot/commit/958cf01649e67c79887c21f9c0ada42b552b7ee3

github.com/jeecgboot/jeecg-boot/issues/4127

nvd.nist.gov/vuln/detail/CVE-2022-45207

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

52.3%

JSON

Related for OSV:GHSA-4J2X-V3MR-467M