CVE-2023-24163: SQL Injection
First published: Tue Jan 31 2023(Updated: )
SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hutool Hutool | =5.8.11 | |
| maven/cn.hutool:hutool-all | <5.8.21 | 5.8.21 |
| Hutool Hutool | <5.8.21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitee.com/dromara/hutool/issues/I6AJWJ#note_15801868
- https://github.com/dromara/hutool/releases/tag/5.8.21
- https://github.com/google/osv.dev/issues/2195
- https://gitee.com/dromara/hutool/issues/I6AJWJ#note_20057806_link
- https://github.com/dromara/hutool/issues/3149
- https://nvd.nist.gov/vuln/detail/CVE-2023-24163
- https://github.com/advisories/GHSA-6c25-cxcc-pmc4 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this SQL Injection vulnerability?
The vulnerability ID for this SQL Injection vulnerability is CVE-2023-24163.
What is the title of this SQL Injection vulnerability?
The title of this SQL Injection vulnerability is 'SQL Injection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine.'
What is the affected software version?
The affected software version is Hutool Hutool v5.8.11.
What is the severity of this SQL Injection vulnerability?
The severity of this SQL Injection vulnerability is critical.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by executing arbitrary code via the aviator template engine.
Is there a fix available for this vulnerability?
Please refer to the reference link for information on how to fix this vulnerability.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6c25-cxcc-pmc4
- alias/CVE-2023-24163
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-cve
- collector/github-advisory
- vendor/hutool
- canonical/hutool hutool
- version/hutool hutool/5.8.11
- package-manager/maven