GitHub Advisoryadvisory · Go

GHSA-pmcr-2rhp-36hr SQL injection in github.com/navidrome/navidrome

MEDIUM Published 2022-01-27 Modified 2022-01-25 Official page ↗
Aliases
CVE-2022-23857
Ecosystem
Go
Packages
github.com/navidrome/navidrome
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2022-01-25

Affected packages

• Go github.com/navidrome/navidrome: < 0.47.5 → fixed in 0.47.5

Description

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Related

Alias · CVE (1)

  • CVE-2022-23857 model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References