CVE-2023-7299: DataGear resolveSql sql injection

Q: What is the severity of CVE-2023-7299?

CVE-2023-7299 has been declared as critical.

Q: How do I fix CVE-2023-7299?

To remediate CVE-2023-7299, upgrade DataGear to version 4.7.0 or later.

Q: What type of vulnerability is CVE-2023-7299?

CVE-2023-7299 is an SQL injection vulnerability.

Q: Can CVE-2023-7299 be exploited remotely?

Yes, the attack associated with CVE-2023-7299 can be initiated remotely.

Q: Which versions of DataGear are affected by CVE-2023-7299?

DataGear versions up to and including 4.60 are affected by CVE-2023-7299.

Published Nov 23, 2024

Updated

A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.

Affected Software

1 affected component

DataGear DataGear<4.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DataGear to a version that resolves this vulnerability.
Fixed in 4.7.0

Event History

Nov 23, 2024

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-7299?

CVE-2023-7299 has been declared as critical.

How do I fix CVE-2023-7299?