A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-225921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?ctiid.225921 | Third Party Advisory |
| https://vuldb.com/?id.225921 | Third Party Advisory |
Configurations
History
21 Apr 2023, 03:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://vuldb.com/?ctiid.225921 - Third Party Advisory | |
| References | (MISC) https://vuldb.com/?id.225921 - Third Party Advisory | |
| First Time |
Assaabloy control Id Rhid
Assaabloy |
|
| CPE | cpe:2.3:a:assaabloy:control_id_rhid:23.3.19.0:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
18 Apr 2023, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-225921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
14 Apr 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-14 10:15
Updated : 2024-05-17 02:22
NVD link : CVE-2023-2043
Mitre link : CVE-2023-2043
CVE.ORG link : CVE-2023-2043
JSON object : View
Products Affected
assaabloy
- control_id_rhid
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')