PT-2023-9130 · Qumagie · Qumagie

CVE-2023-47219 · Publicado 2023-11-03 · Atualizado 2024-01-10

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuMagie versions prior to 2.2.1

Description A SQL injection issue has been reported, potentially allowing authenticated users to inject malicious code via a network. This could be exploited by a remote attacker to execute arbitrary code. The vulnerability is related to the lack of protection measures for the SQL query structure.

Recommendations For versions prior to 2.2.1, update to QuMagie 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL query functionality until the update is applied.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2024-03988

CVE-2023-47219

Produtos afetados

Qumagie

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-47219 · Nota de Segurança
• https://vuldb.com/?id.249801 · Nota
• https://qnap.com/en/security-advisory/qsa-23-32 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-47219 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-03988 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1743355897944948744 · Publicação no Twitter