CVE-2023-47128

{"id": "CVE-2023-47128", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-11-10T18:15:09.870", "references": [{"url": "https://github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-xq59-7jf3-rjc6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue."}, {"lang": "es", "value": "Piccolo es un generador de consultas y mapeo relacional de objetos que admite asyncio. Antes de la versi\u00f3n 1.1.1, el manejo de \"savepoints\" de transacciones con nombre en todas las implementaciones de bases de datos es vulnerable a la inyecci\u00f3n SQL a trav\u00e9s de cadenas f. Si bien la probabilidad de que un desarrollador final exponga un par\u00e1metro de \"name\" de \"savepoints\" a un usuario es muy poco probable, no ser\u00eda algo inaudito. Si un usuario malintencionado pudiera abusar de esta funcionalidad, tendr\u00eda esencialmente acceso directo a la base de datos y la capacidad de modificar los datos al nivel de permisos asociados con el usuario de la base de datos. Una lista no exhaustiva de acciones posibles seg\u00fan los permisos de la base de datos es: Leer todos los datos almacenados en la base de datos, incluidos los nombres de usuario y los hashes de contrase\u00f1as; insertar datos arbitrarios en la base de datos, incluida la modificaci\u00f3n de registros existentes; y obtener un shell en el servidor subyacente. La versi\u00f3n 1.1.1 soluciona este problema."}], "lastModified": "2023-11-20T19:35:23.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piccolo-orm:piccolo:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "355EE2C8-1D3F-458B-8A51-4A6904485DD1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}