CVE-2023-45684

{"id": "CVE-2023-45684", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-11-14T15:15:07.553", "references": [{"url": "https://cfengine.com/blog/2023/cve-2023-45684/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub."}, {"lang": "es", "value": "Northern.tech CFEngine Enterprise anterior a 3.21.3 permite la inyecci\u00f3n SQL. Las versiones fijas son 3.18.6 y 3.21.3. La primera versi\u00f3n afectada es la 3.6.0. El problema est\u00e1 en la p\u00e1gina de inicio de sesi\u00f3n del Portal de la Misi\u00f3n en el centro CFEngine."}], "lastModified": "2023-11-20T16:36:42.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:northern.tech:cfengine:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "67F8886C-B118-40FF-BC20-EA1949E0CF20", "versionEndExcluding": "3.18.6"}, {"criteria": "cpe:2.3:a:northern.tech:cfengine:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "32A9DD95-5CFF-49A6-952B-4FC3080ECB50", "versionEndExcluding": "3.21.3", "versionStartIncluding": "3.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}