CVE-2023-7299

MEDIUM

DataGear < 4.7.0 - SQL Injection via /dataSet/resolveSql sql Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.

References (4)

Core 4
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.285658
Permissions Required signature permissions-required
https://vuldb.com/?ctiid.285658
Third Party Advisory third-party-advisory
https://vuldb.com/?submit.442943

Scores

CVSS v3 6.3
EPSS 0.0062
EPSS Percentile 45.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
datagear/datagear < 4.7.0
Published Nov 23, 2024
Tracked Since Feb 18, 2026