CVE-2023-41262

{"id": "CVE-2023-41262", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-10-12T23:15:11.190", "references": [{"url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en /fcgi/scrut_fcgi.fcgi en Plixer Scrutinizer antes de 19.3.1. La acci\u00f3n de endpoint csvExportReport generateCSV es vulnerable a la inyecci\u00f3n de SQL a trav\u00e9s del par\u00e1metro de clasificaci\u00f3n, lo que permite a un usuario no autenticado ejecutar declaraciones SQL arbitrarias en el contexto del servidor de base de datos backend de la aplicaci\u00f3n."}], "lastModified": "2023-10-16T18:17:04.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plixer:scrutinizer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "390C6B6A-DED5-42CC-84D4-E4A208560B74", "versionEndExcluding": "19.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}