PT-2023-26742 · Wix · Wix-Embedded-Mysql

Publicado 2023-07-28 · Atualizado 2023-08-03 · CVE-2023-39021

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wix-embedded-mysql versions 4.6.1 and below wix-embedded-mysql versions 4.6.2 and below

Since both versions are essentially the same in terms of vulnerability, we can consolidate them into a single line for clarity: wix-embedded-mysql versions 4.6.2 and below

Description The issue is related to a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument to the apply function.

Recommendations For wix-embedded-mysql versions 4.6.2 and below, consider disabling the com.wix.mysql.distribution.Setup.apply component until a patch is available. Restrict access to the apply function in the com.wix.mysql.distribution.Setup component to minimize the risk of exploitation. Avoid passing unchecked arguments to the apply function until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-39021

GHSA-FX3V-4W3W-WPWR

Produtos afetados

Wix-Embedded-Mysql

Referências · 5

• 🔥 https://github.com/LetianYuan/My-CVE-Public-References/tree/main/com_wix_wix-embedded-mysql · Exploit
• https://github.com/wix/wix-embedded-mysql · Nota
• https://osv.dev/vulnerability/CVE-2023-39021 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fx3v-4w3w-wpwr · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39021 · Nota de Segurança