CVE-2023-2681: SQL Injection on Jorani
Published Oct 3, 2023
·Updated
An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database.
Affected Software
2 affected components
Jorani Project Jorani=1.0.0
Jorani Jorani=1.0.0
Remediation
Information
This vulnerability has been solved in the 1.0.2 version, released on May 1th.
Event History
Oct 3, 2023
CVE Published
via MITRE·12:19 PM
Data Sourced
via MITRE·12:19 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-2681.
2
What is the severity of CVE-2023-2681?
The severity of CVE-2023-2681 is high with a severity value of 8.8.
3
Which software version is affected by CVE-2023-2681?
Jorani version 1.0.0 is affected by CVE-2023-2681.
4
How can an attacker exploit CVE-2023-2681?
An attacker can exploit CVE-2023-2681 by sending queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter.
5
Is there a fix available for CVE-2023-2681?
It is recommended to update Jorani to a version that is not affected by CVE-2023-2681 when a fix becomes available.