CVE-2023-38992: SQL Injection
Published Jul 28, 2023
·Updated
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
Affected Software
2 affected componentsFixes available
maven/org.jeecgframework.boot:jeecg-boot-common<3.5.3
3.5.3
Jeecg jeecg boot=3.5.1
Remediation
Patch Available
Event History
Jul 28, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
03:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-38992?
The severity of CVE-2023-38992 is critical.
2
How does CVE-2023-38992 manifest?
CVE-2023-38992 manifests as a SQL injection vulnerability through the title parameter.
3
How can I fix CVE-2023-38992?
To fix CVE-2023-38992, update to version 3.5.3 of jeecg-boot or newer.
4
What software versions are affected by CVE-2023-38992?
The affected software versions are jeecg-boot v3.5.1 and older.
5
Where can I find more information about CVE-2023-38992?
You can find more information about CVE-2023-38992 at the following references: [Reference 1](https://github.com/jeecgboot/jeecg-boot/issues/5173), [Reference 2](https://nvd.nist.gov/vuln/detail/CVE-2023-38992), [Reference 3](https://github.com/jeecgboot/jeecg-boot/commit/648e66d5ef1547a01ff77bf9875f960ca39bbe8e).