CVE-2023-3793mediumexplotación observadaCWE-89

CVE-2023-3793: fallo de gravedad media en Weaver e-cology

Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear e-cology

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 5.5epss 0.5%
de la publicación al arma
Publicada en NVD20 jul
VulnCheck+1011d
A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql injection. Upgrading to version 10.58.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-235061 was assigned to this vulnerability.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
Weaver · e-cology
CVEs relacionadas — Weaver e-cology

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-2806MEDIUMWeaver e-cology API RequestInfoByXml xml external entity referenceEPSS 1.0%CVE-2024-7704MEDIUMWeaver e-cology Source Code ecology_dev.zip information disclosureEPSS 0.8%