PT-2023-4194 · Langchain · Langchain
Asimjalis
·
Publicado
2023-06-06
·
Atualizado
2024-10-15
·
CVE-2023-36189
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
LangChain versions prior to 0.0.247
Description
The issue is related to a SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component. This vulnerability is due to the lack of protection measures for the SQL query structure, which can be exploited by an attacker to gain unauthorized access to protected information.
Recommendations
For versions prior to 0.0.247, update to version 0.0.247 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQLDatabaseChain component to minimize the risk of exploitation.
Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Langchain