GitHub Advisoryadvisory · Maven

GHSA-9v66-9239-cqv2 Jeecg-boot SQL Injection vulnerability

MEDIUM Published 2023-08-17 Modified 2023-08-23 Official page ↗
Aliases
CVE-2023-38905
Ecosystem
Maven
Packages
org.jeecgframework.boot:jeecg-boot-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-89
Reviewed
2023-08-18

Affected packages

• Maven org.jeecgframework.boot:jeecg-boot-parent: <= 3.5.0 (no fix yet)

Description

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the `Benchmark`, `PG_Sleep`, `DBMS_Lock.Sleep`, `Waitfor`, `DECODE`, and `DBMS_PIPE.RECEIVE_MESSAGE` functions.

Related

Alias · CVE (1)

  • CVE-2023-38905 SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark,… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References